200080, 0x0) r2 = accept(r0, 0x0, &(0x7f0000000080)) sendmmsg(r1, &(0x7f0000000240)=[{{&(0x7f0000003900)=@pppoe={0x18, 0x0, {0x0, @remote, 'ip6gre0\x00'}}, 0x4b1, &(0x7f0000003b80), 0x0, &(0x7f0000000200)}}], 0x44b, 0x0) dup3(r2, r1, 0x80000) close(r2) close(r1) [ 339.107365] binder: release 12374:12376 transaction 123 out, still active [ 339.114763] binder: 12374:12378 transaction failed 29189/-3, size 0-0 line 3035 [ 339.122733] binder: undelivered TRANSACTION_COMPLETE [ 339.127907] binder: send failed reply for transaction 123, target dead 01:47:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:19 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, 0x0, 0x5000000) 01:47:19 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) socketpair(0x0, 0x0, 0x9, 0x0) r1 = accept4(r0, &(0x7f0000000800)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000300)=0x80, 0x80000) sendmsg$rds(r1, &(0x7f0000000fc0)={&(0x7f0000000780)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000ac0)=[{&(0x7f0000000880)=""/191, 0xbf}, {&(0x7f0000000940)=""/138, 0x8a}, {&(0x7f0000000a40)=""/82, 0x52}], 0x3, &(0x7f0000000e40)=[@rdma_args={0x48, 0x114, 0x1, {{0x4, 0x6}, {&(0x7f0000000b00)=""/64, 0x40}, &(0x7f0000000c80)=[{&(0x7f0000000b80)=""/162, 0xa2}, {&(0x7f0000000c40)=""/29, 0x1d}], 0x2, 0x21, 0x2}}, @mask_cswp={0x58, 0x114, 0x9, {{0x1, 0x100}, &(0x7f0000000cc0)=0x2017, &(0x7f0000000d00)=0x9, 0xd27, 0x1ff, 0x1c0d, 0x0, 0x40, 0xfffffffffffff000}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x400}, @fadd={0x58, 0x114, 0x6, {{0x0, 0x1}, &(0x7f0000000d40)=0x4, &(0x7f0000000d80)=0x6, 0xbe, 0x200, 0x4, 0x3, 0x60, 0x4}}, @mask_fadd={0x58, 0x114, 0x8, {{0x7, 0x8}, &(0x7f0000000dc0)=0x5, &(0x7f0000000e00)=0x1, 0x20, 0x3, 0x3, 0xc0000000000, 0x18}}], 0x168, 0x4000804}, 0x880) pipe(&(0x7f0000000480)={0xffffffffffffffff}) pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$cgroup_ro(r3, &(0x7f0000000280)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$rds(r5, &(0x7f0000000b40)={&(0x7f00000002c0)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f00000005c0)=[{&(0x7f00000004c0)=""/231, 0xe7}], 0x1, &(0x7f0000001000)=ANY=[@ANYBLOB="01000000000000000000000001000000080000000000000039000000000000000000000017b557ed20b5fce9ed8b16f821af0863c76facabea656751b98c096f940ee3bc6bda2ef171ccc81f948475f3c1e790b363cd3ec2c3a4b4abebde11c981bbe8cd1e978b9264b6693430eb8cad71951b6aac48ec406fa14e85219c4b14e354916a6bd9601b5a29020e9b495de50e45ef983ae62edd784a6307eb9127018ed83401"], 0x24, 0x800}, 0x48001) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000007c0)=ANY=[@ANYBLOB="d68b05f214776fbb190000"], 0x0) r6 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, 0x0, &(0x7f00000013c0)) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6f) r7 = openat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0, 0x0) fstat(r2, &(0x7f0000000700)) syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') socket$inet(0x10, 0x3, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f00000006c0)={0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000380)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0xc204, &(0x7f0000000000)) ioctl$DRM_IOCTL_INFO_BUFS(0xffffffffffffffff, 0xc0106418, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x10}) r8 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r8, 0xffffffffffffffaa, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r7, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x8d6}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r5, 0x84, 0x78, &(0x7f0000000200)=r9, 0x4) getsockname$unix(r6, &(0x7f00000003c0), 0x0) 01:47:19 executing program 3: inotify_init1(0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rfkill\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) write(r0, &(0x7f0000000580)="469ec3a8df868f51e475125253bf80641b1868d1f8390244777814a6d1ad28100fd5081e06249e67fe7255bf037b9e956d5c7111c2771999a6e79e927e36d361c4b8fe8c876b98be1da988208c76f76f66097f0e5a84b4c647b73ddf040fdf418f85ef898f8740a864b6f9ae19428e6d4b3eb4d90c06c2e0ee3fa8b2ac0805440e4059cffa84c6ba84f0c09f3201fa636016ff9d650bc417198947086619142c5b411eb3828c7580353af0268014d86d38920781c7f15b7d0aea9a72f643538747c42cb92fd319", 0xfffffd8b) openat$vnet(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-net\x00', 0x2, 0x0) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) shutdown(r1, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) [ 339.205845] binder: undelivered TRANSACTION_ERROR: 29189 [ 339.234984] dccp_flush_write_queue: CCID did not manage to send all packets 01:47:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c1f023c126285719070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c00000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012000c000100626f6e64000000000c00020008001400ffffffff"], 0x3c}}, 0x0) [ 339.347827] binder_alloc: binder_alloc_mmap_handler: 12403 20001000-20004000 already mapped failed -16 [ 339.357065] dccp_flush_write_queue: CCID did not manage to send all packets [ 339.412626] binder: BINDER_SET_CONTEXT_MGR already set 01:47:19 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x5000000) 01:47:19 executing program 4: r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000280)=0x1, 0x8) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x3a}, &(0x7f00000000c0)=0x8) getsockopt$inet6_dccp_int(0xffffffffffffff9c, 0x21, 0x17, &(0x7f0000000140), &(0x7f0000000180)=0x4) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={r2, 0x101, 0x100}, 0x8) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00') [ 339.443923] binder: 12403:12407 ioctl 40046207 0 returned -16 [ 339.457165] binder: send failed reply for transaction 126 to 12403:12407 [ 339.503393] binder: undelivered TRANSACTION_COMPLETE [ 339.531764] binder: undelivered TRANSACTION_ERROR: 29189 01:47:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:19 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)}, 0x5000000) 01:47:19 executing program 5: r0 = userfaultfd(0x8000004) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f00000038c0)={'broute\x00', 0x0, 0x3, 0x3a, [], 0x6, &(0x7f0000003800)=[{}, {}, {}, {}, {}, {}], &(0x7f0000003880)=""/58}, &(0x7f0000003940)=0x78) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000003000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f000000f000/0x4000)=nil, 0x203d1f}, 0x1}) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000000)) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000000c0)={0x0, @speck128, 0x1, "9938d162ea6a1a8a"}) r2 = msgget(0x3, 0x400) msgsnd(r2, &(0x7f0000000040)={0x0, "ee1ab35600b32f03688e8177bc1d3e4f8d2ca3dd475d0885c93012d4634b026e14921807ead12b3fc27acb08c38552d69699e35c5bbdec4dbaecb421bcc556c3fb64747f0b101782710212f68eeef2f82ff3739611011ebd2dcc647a6ba79e8d5885c18aa62cd2c4333fce570f"}, 0x75, 0x800) 01:47:19 executing program 4: r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001280)='/dev/kvm\x00', 0x100020000, 0x0) r2 = getpgid(0x0) ioprio_set$pid(0x3, r2, 0x3ce6) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_CLOCK(r3, 0x8030ae7c, &(0x7f0000000080)) getdents64(r0, &(0x7f00000000c0)=""/121, 0x79) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip6_flowlabel\x00') r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) r7 = syz_open_dev$adsp(&(0x7f0000001380)='/dev/adsp#\x00', 0x1, 0x28080) ioctl$TIOCGPGRP(r7, 0x540f, &(0x7f0000001340)=0x0) fcntl$lock(r6, 0x6, &(0x7f0000000080)={0x0, 0x2, 0xc701, 0x8, r8}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x0) r9 = syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) pread64(r9, &(0x7f0000000080)=""/4096, 0x20001080, 0x0) gettid() sched_setaffinity(0x0, 0x8, &(0x7f0000000940)=0xfffffffffffffc00) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) symlink(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000380)='./file0\x00') ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r4, 0xc0305616, &(0x7f0000001200)={0x0, {0x4, 0x100}}) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000)) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000680)={0x1f, {0x0, 0x9, 0x3, 0x0, 0x0, 0x7}, 0x400}, 0xa) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f00000012c0)={@loopback, @multicast2, 0x0}, &(0x7f0000001300)=0xc) sendmsg$nl_route_sched(r5, &(0x7f0000001440)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x101}, 0xc, &(0x7f0000001400)={&(0x7f00000013c0)=@getqdisc={0x3c, 0x26, 0x622, 0x70bd2b, 0x25dfdbfc, {0x0, r10, {0xffef, 0xffff}, {0x3, 0xb}, {0xc, 0xffe0}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_IP_XFRM_POLICY(r7, 0x0, 0x11, &(0x7f00000010c0)={{{@in6, @in=@broadcast}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f00000011c0)=0xe8) r11 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r11, 0x7001) [ 339.707512] binder_alloc: binder_alloc_mmap_handler: 12438 20001000-20004000 already mapped failed -16 01:47:19 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[]}}, 0x5000000) [ 339.752233] binder: BINDER_SET_CONTEXT_MGR already set [ 339.767457] binder: 12438:12439 ioctl 40046207 0 returned -16 01:47:20 executing program 5: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14103e, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_OPEN(r1, &(0x7f0000000180)={0x20}, 0xfffffcad) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) sendfile(r0, r1, 0x0, 0x10000000000004) mlock(&(0x7f0000004000/0x4000)=nil, 0x4000) mbind(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x2) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2040}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r3, 0x4, 0x70bd28, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x404c005}, 0x1) [ 339.811404] binder_alloc: 12438: binder_alloc_buf, no vma [ 339.832956] binder: 12438:12453 transaction failed 29189/-3, size 0-0 line 3035 [ 339.852766] binder: release 12438:12439 transaction 128 out, still active 01:47:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 339.871625] binder: undelivered TRANSACTION_COMPLETE [ 339.902894] binder: undelivered TRANSACTION_ERROR: 29189 [ 339.932878] binder: send failed reply for transaction 128, target dead [ 339.978645] protocol 88fb is buggy, dev hsr_slave_0 [ 339.983801] protocol 88fb is buggy, dev hsr_slave_1 01:47:20 executing program 3: futex(0x0, 0x400000085, 0x0, 0x0, &(0x7f0000004000), 0x1f000000) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x4, 0x200000) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) restart_syscall() 01:47:20 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x0) 01:47:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 340.218678] protocol 88fb is buggy, dev hsr_slave_0 [ 340.223805] protocol 88fb is buggy, dev hsr_slave_1 [ 340.311706] binder_alloc: binder_alloc_mmap_handler: 12470 20001000-20004000 already mapped failed -16 [ 340.349028] binder: BINDER_SET_CONTEXT_MGR already set 01:47:20 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x0) [ 340.369069] binder_alloc: 12470: binder_alloc_buf, no vma [ 340.381859] binder: 12470:12471 ioctl 40046207 0 returned -16 [ 340.406703] binder: release 12470:12471 transaction 131 out, still active 01:47:20 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xde\xe9\x01\xd2\xdau\xaf0\x02\x00\xf5\xab\xfb\x98E\xf9\xe1\x98Y\xc9i2\x06\xf2\xc6\v\x00\x00\x00\a\x19\xe1\xd6n\x97\x01#\xd8\x93\xd9t\xe5\xb9\xc3(Vw\xb2\x13\x98#\xe5P\f\x92\xab[\x94\xda:}\xe1\x9f\x06;\xb7e\xb0+\xd5\xb6`\xfb\x7f\xa8\x98\xc6\xf5\xc66\x9c?60h\xd1\n\xf83\xf6G[\xbe\x8byg%[\x17v\a\xba\x10\x0flFTq\x822\xdb\xdad\xaa\x1fi\xcf\x9a\xb5\xb3\xea>\xd64R\xb7\xeb\xd3|\x9d\xaefN2.\b\xad\x8f`)\xfe\x8f\xd0\xb3Lq\x17H\x04q\xae\xca\n?\xc9\xec\xeb(P\x9c\xa8\xa8>O\x8b\x85\x13\x18\b\xbc\\\xfbL\xc2N\x19\x01v\x9c\bL\b\'\x12\xb4pfkm\xdd\xf7L\xedi9s\xba\x1d\xed\x8b') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fchown(r0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000002c0)={0x0, 0x1000, "7f7f2f1d147176e0483d7a690e3be7a7d0ac5c9eede926345427c9d76efe46451c5af2d1a50fd98be46aa385cede5233135e35fd36b5dc2ddfb6a0d9ba0fef8daeb7be1fda056d16888ffbe2cb9af053b72ab7267fba832d54abf92a307034e2adde47f448aa9265b519495befec269021239d3774519d33d0edec290170845c4291753d501629211bacf984cbdd3f9d7f3015a1ef545a88781e2783457a3b68870d13788686583f7be775dc669ecdf2fef085432f6204170a4a130ac16ba5951e8c19891033a81eec13f9422a98da00aa4500d4cb9de23a0d7dd9353fe5eac600e537f68c8ff6e842bf07cfac24875bbcd0205a8043d9314fd853258945cddbc2b50c4c6329473d786f84659abb291f530998742e470c60edbba65691f5bcd402a5f10e9f5efa1fc0dd2c090ae1b7d4400396396f68b7b91273bb87fbe131a5f293c351159e87d566e2fb1752cfb5c03ad6c7cdf5e323733b26f6f955215af3cf56c02582f0cc45a46e449f12ce03b21880400bac46361ad14dd76704770db20719920441f45ff7b884b434e13e4f896c21d305c33fa0b9a85b555e3bc58b59df0d9d61e0a42d668e3aff16c2ed2ce8718c5121b9df5553c442a1facd263d00f3f954e65a2fff6922ce622c9408740caf33b874cb2fe62aab62942e7c1bbe5b1483b33866d31faa2b68fae320d957e10a536cd9b06faa6d0f527859a7926b4b887600f47309c2ca5349d7598ab3d68d74486e5b2f93eb12e75cc6394bce97cfd5e786a7c5dfbc9ae1062feb3e97cb75a16c8f7b3edeacb0ca5b5aadba66ebc485f3289bce6544f8a55a2078b9c7d875dcd1ad5000b51044e67e73f22e80a2353f69f4db3f6bc36cb1b69005353cc82ba02bf4ad0fa925206c6e46b39d5913200d0a52e51b86d21a8474d3a64556ab20113c16c9ba1e213fae585d6e44d0cbfe402a41ad0a30562848a43e20f92b18438397331c1b63d1821187652f87f7cfdac6b88099cc4b450b6c0e9d91e7f3b75f239131c837f762cf570ff8639d1865b69e2571098af45002d7a4e75f0cbcb83d8b2a24a28dc05b97c852eb3f5d5b42dfee1eccf25f09ae2655852fdef87485693c0dba30567721cc14665498c43049f51a8dd27e8fd8b2d826e09ef1d226ce4214d5bc5245a719c917bb3c6fd0295dcc5ad9631b0b35c6ee70d22a06d142c2a895a64da9dfa79694d1f87faabd86a29b2ae81d107a47f389b36be30dad58a0f53ed8dd22224bccb027570d22faf111cbd09139930b09c9e5fe99775195552d5424a344c14ed23fe58e40fbce8776fc9eb4d48d2c6741f48821a970af3efa9006d408f837902ea4914f3f9e9441541fe79943bcb60de8a876f0562677fd8aa9e75a07c42de0026616594475a209f4a6be78b69572bc97ef1b530b44daa2eca2d1d8712a34482aaef95e2c0222249715984b298b0547ba27e9d2c769ae2d8a43b46b404086d2b55c7368f77ffc053674786290f3145f56e1449b7693e8a0393cf928d2019dad76025d3aba0f1b0c9081e3c6c80e222564514531129e5d49280a681fc7b3148ab5a3d541e82cd1993d8d4a1e959ac1b2a172eadea851095e941417e398434da46559dae57aa52fdb452775dcc580a302dfe5aeb756434bb9c567b3375f0d7871b7b99441584732b7801ab3474d3f122793cbe43fafb8b59560ebd86f61258ee27885da06949c9f30e030cf6fc8e437a2539a5547df44d3d10a7fbf128ef0cb60320815e5360ac4d011aab7f2aceddfb4b31cea8a2deabaf9b414b7fa8f7f4f90ded79d74b17a88aa6deae2fb1a1f35659f53f69d9d4cfb4d3dda99307e45a768183c397138f7f0a5fc640a6decd90cd217c1c881068866f0bc96980a94592b0cc226395394d9300105f0db1e99dc8c91fe78d901211a1bd7c5ce0d0dea6b9be381fb1a981d51fcb98c07f986ecba131d39dcf85b70c725461ea6c958d8c5f139d46e865132401639a8892ea4b517d325563d80bb846c7755aa883c4a9918c54a1ca8fd69f3c613741792c18c9b7a19ae37a62a666c5e19747928af5995f61ebabd289cddbe59763c38fc16c18c71a0d6d6013946eaa24af7d0d56ea74deb06836f04c1ad54013ec5e2d54f514c21fcd5291806af5c879f1afe65cf5a366e3bb1f398aa2a86fc7131f652c98c88bce7918566f847e461b9823a74bfebf451b0630930a2353b318e4f6d2474dded34538f118f2d8f97b0f47b4fe4bf11311aba0e382e1b0cf7a8915b977b0f4ea00616c2fbdd7a45976e7b1da3d7c84d49ce24b63ff8d60604443eb2ed5e193699efb2560a6bcee201cc7e87fc407239c7728cc979ad44efda6dcc5bbb97095a4ced24471b1809fde51ae15076a1b201a653c54928b4783aca9f7908d78d4e0458bb3e299c61da0f08510f3c7f7fb18940af05cf510de712933df75601c44744f356a9c02ca706452fc8b70a514fdfaf04da150530b0e7b4eb197e8f1e45b23428f0ede6691dbb18f0a0bb042c950dae5ec593b48ebe595ef68e3f1f34b1ad1c994995cf7dd8d85ae33c91d21dcec12ab2179f5f175f6c8de3839299b20ae488cf2cf404fe5e7881790f0299cf2c3702ceb9958598267563995c80052606d76cfe11ce6d2b22b948f7b1a246704f769ecdf097f49999512bc02018e90885d3e36d7e33c40a3695735300927c8d878e987c4058cb9244dc06d9f1717bec07ae5f13d344a48a422e4b78415e89f254a19db377f9e76d546c9ed7151ce74052bf4bdd33e4c4c102b69a54e5773ed6e49b396ff49fbf25b7f9f861040a9c4379069e4353cc3eab4a6858d9b88416fccb1c1f0ae48f7d2eb3f9398646025f947ff495c6d8ff6c43b06b6b20636e28185a904b4ced3b0a8f6686afdf0414d296ee22a8297773cb5ab825c5bd0f03b948e30b4212b80353f719b597b35a78cace338f4e9c52ed756150a656302d7a626f21b23174d6b06308c00ccc83b8d4e46f1e7d8424ca8ebf9d9ed6d1ea39767f6bf5610edb3ac3c106d64d404469e3989839dbfe5bb5811c5a92e0358d79a3535dc871c7341de23df4ac6cd0a5e250ffa101647ccdcfd0695bbfd374b6cd6dc160ab19e079cde27dd3a64f25f3099cf50401a242a4ca39f4c5e899040c5233bfbe09a0081a02ea24bc9808bade9398659cf01b3529224aaa2af399fbc5df8c07dcb6b2ce10d01c46ebf03a43c5a6133fad0625680d2f2caa9638b0de546796790046819be88c212720bcea360a996b46b6665ee9078a16d86b69768e00ee409452487762582f46c5d842cbb803b565047d8f27fe98bb7930fbfe5fe55f6b65c91aaee29429b1581d2648049270aebd98a82256da2262bc1980c4d8fc6c3fbc017a7dcddc49b77e1d7df6fdcc602a59aa311811fb577009409ade30317cd63b00675a638d16fa14987cc620c3b91f12565e415140f42921e09b6c2de6e0a77b1f2bd903323562556890d0236dd037d393c8371818f1473b0e9f8dee46d796500c447aa070323bbed38e17135a24253c3c4591ec0d874dc7f45b510c5bbb700f25ec2b88987581eddcee07fa72ed375b780e8b15c6a25575a7881a3bb284243005934ea3d9df06169aff02d687f3704fd6cbc0925fcecd51e329d6563e1c82d8422b529fcedda74a3c8f6562d7930a8b830d59e6bbb5246ef20f419aa57087cb62cf99af31e32839a7e3f437e52b62cbfa490e44a96c281e9bcd92b325f5dfd7d5f2396da2c85e6c4b800773b701811252ef9c26f754bd82d9d6a2bcbbdb64e3a18d3c5b23b35bc4015a5075e48cf4a10a33f7a9ffdf036f75e9231d50f1338282781173c516a48c29a0a839b19eb48cea3da85d27fdc321f20766a20ea646b73f882945f352b40942e5edcd33afbb2ee8452079fb25b35819666f4da1d3c7799a05b659212a698abba0c722b13d0b70b02751a7556746eb489cc27bb1405af8bb24276b8f9484d2484ed7402fbc201a3507369147a319fbdb829906e3da272f0ddf6cc9ac62b8f20d7b329135d2b4e775334687c9f027517430286127b71f12683ac028f68cd26a5ae24a84604c84c77868f501bc6010d2cfe094d28c4dc1dbcc40caaa2d368e503e57b7c8bebf60258e3c5122752cdf37d8b5f69674a64115649b67fe7e269b835b1ba15abf7041686030b53bf3df2d8cbfffb935d54ff1bdbbb8168bd2b1372095beeeb58dffaecb2aa4ceeb9627d2bd0dee79a5a5f05bb507680a85a7df7be19ee905320338fff1e85799249d645cf5a420151f490aeabb9543a9ae8ff53a4cd5e0863306c0e61ed7dc56f64d4a4c4a2628ceae0259b92a9b8a2a83ddb8bdae7b19c02f4be814edc0f33c3f5cd7cf9372d53d1d18c50c2d5eb0a7a7c38362ed8af296f32a091764749fcc7950f929ac4e5f878d4ca6e1dad4a0bcdefd4ade04407c2a9b4e5f129720f34f86ca4c0179f3751dfc08847c8a5bc70bcfe1c377aad1d2b71bc6fc9c98a78cd22a78fb87717a15aef6e44097a350e0dc1fff1c761bc63e18cd297f31c523be8123b4a3948d929cb547ca473ca338fadfe71e1b19d470b3379e60371aeb06cafdbff8fbcfd3ed277113aa6cd684bd631270b4f5931e3e156131a62702aea5a38e02d9646154b741a6c00e671ba17f25b3bdd8f9285d4ff496f9ab3dabf4ef8ceda98e9365b036f8fdd62439436896e8501b0cf1d776eace617f4cb7e6a46844e75280a1d9afb6e2bbced6929f5375ea39309211e0117860a370ccd3f3f5737f2aa3cd77db7b53f94037c6f282b1692af8eda4ba84e54d158239cb5716920125481146433627a102f7dbdba857cebb485edf1a4f1e4ac8cab64db8299eb19192585373fbbe532d6bd89af5ed2caa7713557e8c31ed94ecaca6e3c899280cd69767a510276eeb4bef9f4085499199ffe3e777af860def6fdd2115934e0eb40b2efb9c482eeee9b50486c3ec2212e62cd1742af6874b0e2ba5f02fd20b9164c00f86879d932c6cd435abd5d7e83d67490da20c2874e7bd6f599b65314fcf7cd13460a69d0585e85c092a6b499dfb66ad0618bf5ac6b3fb6e24ad8bd6d3046e0c64d4e643dfafe56464740770a76ded0c73c98e31fc827899bb14be07d68388ab0f0ed794ee0685328e7fec7ab78f88381c2dba9807c3b05bda2c46f8ac10598ebf214538f004aa0d1bc385938481b11c2ca925ca03f2b140613243c4ef9518c1f888bbb6eae2901f05e7ce12c557fd6239391bd6d5e84845c35e03a40c52a14a438da678b6dd3bf47439f289aa73fdac927664f0ee2bae68768aed9f97e1b18c4f6ab1c3b00000648dd92a9a0fd86a7c17fddd5fbfd9c0bb6c1f4cc088baba73fefbed267df8c523d99bd4706aaee2459c2e85a414aef2aaec03d55509ad6026ca3056afbd017a5a25a066ad6df20876b11c7ec2b7daf59c94a78aa263890230abc611bb2a99a123e03857f7ac57c2d21ed588dcd6feedfac5951a2f725512909a75a2f2935139b93f7c2325227702ad5ecde7d0bd4b5679c8882b2a25ac7f1525c5bb4dfeb8f9a859b1507f3c14a742dedb2e370f66ef796f9a103c7928eaf5047e2ac7a3b3a893fb3008d564430b02fa281acd96fc5af0c275b4a206baca7d8cdc0692b2513c4286fb24f626bebbcc42313160fc9b2b5176ae054a9f3d7523f5a4bca82615ccb05f526695f7659cfaeb2e8400e2fac8cb1adb925339c16afcd46b70d81e12062b9407153aed3331cec97d881e1312e572c9bc646d99768479ad413fad1200fae2492c881ee6a3ad440d42dfdcbdac71577b3b33b5bb22fe36724e65"}, &(0x7f0000000040)=0x1008) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={r2, 0x6bff, 0x2, [0x2, 0x6b]}, 0xc) [ 340.414227] binder: 12470:12475 transaction failed 29189/-3, size 0-0 line 3035 [ 340.434283] binder: undelivered TRANSACTION_COMPLETE [ 340.458397] binder: send failed reply for transaction 131, target dead 01:47:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:20 executing program 5: open(&(0x7f0000000040)='./bus\x00', 0x20000, 0x1a2) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip_vs\x00') getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000500)={0x0, 0x20}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={r1, @in={{0x2, 0x4e23, @broadcast}}, 0xfffffffffffffffc, 0x100}, 0x90) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) sendfile(r2, r2, 0x0, 0x10013c93e) name_to_handle_at(r0, &(0x7f0000000380)='./bus\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="d9000000250a0000fd1c7bc21f35803239d8d61c299fc7094b8e1db47da839435fecde488dc781f357d87065971ae953e206317586728d7f5ae25b89ef89c0b495f2190a11e0b37683822f060054c5de551a451fa0c6d54310cd070deacf618ab9d6ebb355410a08ea3135bc236ae8ecffdb452f338bee7e5d8107ab2e78cbd44c1ba9b8448e4f21edc184200f28dee64c7b61e35bcc5e6079e7bc4f2ef00d843a2deb1f73c281dbcca0b3ad6ae802c08789e924433d0c389873beea2982f65be79c00ced0323800000000"], &(0x7f00000004c0), 0x1400) write$evdev(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000080)={'veth1_to_bridge\x00', {0x2, 0x4e20, @rand_addr=0x200}}) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x100000001}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000140)={r3, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x299) [ 340.465470] protocol 88fb is buggy, dev hsr_slave_0 [ 340.465560] protocol 88fb is buggy, dev hsr_slave_1 [ 340.519697] binder: undelivered TRANSACTION_ERROR: 29189 01:47:20 executing program 4: pipe(&(0x7f0000000140)) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x74, 0x4) openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x800, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) r1 = getpgrp(0xffffffffffffffff) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000200)=r1) fcntl$getownex(r0, 0x10, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0x0, 0xffffffffffffff9c, 0x0, 0x4, &(0x7f0000000400)='em0\x00', 0xffffffffffffffff}, 0x30) r3 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x9af, 0x4000) write$P9_RREADDIR(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="2a000000290200600300000000000000030000000000000000000000faff00000307002e2f66696c6530"], 0x2a) perf_event_open(&(0x7f0000000340)={0x3, 0x70, 0x800, 0x8, 0x8, 0x1, 0x0, 0x65, 0x40303, 0x0, 0x40, 0x0, 0x8001, 0x7, 0xed6f, 0xb3, 0x100000000, 0x3e, 0x0, 0x0, 0x6, 0x1e3, 0x0, 0x8000, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x373, 0x0, 0x0, 0x0, 0x652f, 0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, @perf_bp={0x0}, 0x10, 0x3, 0x1, 0x9, 0x0, 0x7, 0x4}, 0x0, 0x9, r2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, &(0x7f0000000700)) ioctl$BLKBSZGET(r3, 0x80081270, &(0x7f00000001c0)) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080)=0xda9, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = pkey_alloc(0x0, 0x2) write$P9_ROPEN(r3, &(0x7f0000000300)={0x18, 0x71, 0x2, {{0x0, 0x1}, 0x1}}, 0x18) pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, r4) write$binfmt_elf32(r2, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, 0x0, &(0x7f00000002c0)) ioctl$KVM_KVMCLOCK_CTRL(0xffffffffffffffff, 0xaead) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, 0xffffffffffffffff) readlinkat(r2, &(0x7f0000000040)='./file2\x00', &(0x7f0000000740)=""/4096, 0x1000) lsetxattr$trusted_overlay_origin(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)='trusted.overlay.origin\x00', &(0x7f00000005c0)='y\x00', 0x2, 0x1) 01:47:20 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x0) 01:47:20 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x1, 0x0) 01:47:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:20 executing program 5: r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = accept(r0, &(0x7f00000002c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000000)=0x80) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f0000000140), &(0x7f00000001c0)=0x4) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x10f, 0x0, &(0x7f00000004c0), 0x0) r5 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000, 0x0, 0x0) pipe2(&(0x7f0000001600)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r6, 0xc0305602, &(0x7f0000000280)={0x0, 0x8001, 0x0, 0x1}) ioctl$VIDIOC_QUERYMENU(r6, 0xc02c5625, &(0x7f0000000100)={0x0, 0x0, @value=0x80000000}) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000180), &(0x7f0000000240)=0x8) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000540)={0x0, 0x0, @pic={0x0, 0xfffffffffffffffd, 0x0, 0x0, 0xb3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x484b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$TIPC_NL_LINK_GET(r6, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x800) ioctl$DRM_IOCTL_AGP_ACQUIRE(0xffffffffffffffff, 0x6430) pwrite64(r5, &(0x7f0000000140), 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r7, 0x8905, &(0x7f00000000c0)) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, 0x0) 01:47:20 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) [ 340.796202] binder_alloc: binder_alloc_mmap_handler: 12508 20001000-20004000 already mapped failed -16 [ 340.843368] binder: BINDER_SET_CONTEXT_MGR already set [ 340.851343] binder: 12508:12509 ioctl 40046207 0 returned -16 [ 340.857930] binder_alloc: 12508: binder_alloc_buf, no vma 01:47:21 executing program 0 (fault-call:6 fault-nth:0): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:21 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x1, 0x0) [ 340.884383] binder: 12508:12519 transaction failed 29189/-3, size 0-0 line 3035 [ 340.889651] syz-executor3 (12514) used greatest stack depth: 17864 bytes left [ 340.954163] binder: undelivered TRANSACTION_ERROR: 29189 [ 340.978220] FAULT_INJECTION: forcing a failure. [ 340.978220] name failslab, interval 1, probability 0, space 0, times 0 01:47:21 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) 01:47:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 341.005104] binder: send failed reply for transaction 134 to 12508:12509 [ 341.026092] binder: undelivered TRANSACTION_COMPLETE [ 341.034235] binder: undelivered TRANSACTION_ERROR: 29189 [ 341.070941] CPU: 1 PID: 12526 Comm: syz-executor0 Not tainted 5.0.0-rc1+ #15 [ 341.078539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 341.078547] Call Trace: [ 341.078572] dump_stack+0x1db/0x2d0 [ 341.078596] ? dump_stack_print_info.cold+0x20/0x20 [ 341.078630] should_fail.cold+0xa/0x15 [ 341.078662] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 341.108439] ? ___might_sleep+0x1e7/0x310 [ 341.112601] ? arch_local_save_flags+0x50/0x50 [ 341.117193] ? print_usage_bug+0xd0/0xd0 [ 341.121268] __should_failslab+0x121/0x190 [ 341.125515] should_failslab+0x9/0x14 [ 341.129331] kmem_cache_alloc_node+0x265/0x710 [ 341.134448] ? print_usage_bug+0xd0/0xd0 [ 341.138613] __alloc_skb+0xf4/0x730 [ 341.142255] ? skb_scrub_packet+0x440/0x440 [ 341.146578] ? __lock_acquire+0x572/0x4a30 [ 341.150813] ? mark_held_locks+0x100/0x100 [ 341.155052] ? check_noncircular+0x20/0x20 [ 341.159291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.164839] sock_omalloc+0x153/0x280 [ 341.168651] ? __sock_wfree+0xc0/0xc0 [ 341.172452] ? print_usage_bug+0xd0/0xd0 [ 341.176533] sock_zerocopy_alloc+0xa5/0x3b0 [ 341.180865] ? kfree_skb_list+0x60/0x60 [ 341.184845] ? __lock_acquire+0x572/0x4a30 [ 341.189079] ? mark_held_locks+0x100/0x100 [ 341.193322] sock_zerocopy_realloc+0x32c/0x640 [ 341.197911] ? sock_zerocopy_alloc+0x3b0/0x3b0 [ 341.202495] ? mark_held_locks+0x100/0x100 [ 341.206738] ? __lock_acquire+0x572/0x4a30 [ 341.211010] __ip_append_data.isra.0+0x15d1/0x3350 [ 341.215945] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 341.221232] ? ip_reply_glue_bits+0xc0/0xc0 [ 341.225575] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.231118] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 341.236828] ? find_held_lock+0x35/0x120 [ 341.240891] ? sk_dst_check+0x3a7/0x760 [ 341.244866] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.250409] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 341.255944] ? ip_setup_cork+0x53b/0x870 [ 341.260008] ip_make_skb+0x2b8/0x350 [ 341.263733] ? ip_reply_glue_bits+0xc0/0xc0 [ 341.268060] ? ip_flush_pending_frames+0x30/0x30 [ 341.272815] ? sk_dst_check+0x488/0x760 [ 341.276794] ? sock_def_write_space+0x990/0x990 [ 341.281552] udp_sendmsg+0x28b5/0x3a40 [ 341.285457] ? ip_reply_glue_bits+0xc0/0xc0 [ 341.289791] ? udp4_lib_lookup_skb+0x440/0x440 [ 341.294390] ? ___might_sleep+0x1e7/0x310 [ 341.298546] ? arch_local_save_flags+0x50/0x50 [ 341.303137] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 341.308164] ? __might_sleep+0x95/0x190 [ 341.312142] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 341.317071] ? aa_sk_perm+0x234/0x8e0 [ 341.320882] ? aa_af_perm+0x5d0/0x5d0 [ 341.324686] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 341.330230] inet_sendmsg+0x1af/0x740 [ 341.334032] ? udp4_lib_lookup_skb+0x440/0x440 [ 341.338619] ? inet_sendmsg+0x1af/0x740 [ 341.342597] ? ipip_gro_receive+0x100/0x100 [ 341.346979] ? apparmor_socket_sendmsg+0x2a/0x30 [ 341.351745] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 341.357322] ? security_socket_sendmsg+0x93/0xc0 [ 341.362086] ? ipip_gro_receive+0x100/0x100 [ 341.366444] sock_sendmsg+0xdd/0x130 [ 341.370178] ___sys_sendmsg+0x7ec/0x910 [ 341.374368] ? copy_msghdr_from_user+0x570/0x570 [ 341.379123] ? iterate_fd+0x4b0/0x4b0 [ 341.382933] ? lock_downgrade+0x910/0x910 [ 341.387089] ? __fget_light+0x2db/0x420 [ 341.391070] ? fget_raw+0x20/0x20 [ 341.394542] ? __mutex_unlock_slowpath+0x195/0x870 [ 341.399481] ? wait_for_completion+0x810/0x810 [ 341.404073] ? __fdget+0x1b/0x20 [ 341.407442] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 341.412981] ? sockfd_lookup_light+0xc2/0x160 [ 341.417480] __sys_sendmsg+0x112/0x270 [ 341.421376] ? __ia32_sys_shutdown+0x80/0x80 [ 341.425803] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 341.431168] ? trace_hardirqs_off_caller+0x300/0x300 [ 341.436281] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 341.441051] __x64_sys_sendmsg+0x78/0xb0 [ 341.445114] do_syscall_64+0x1a3/0x800 [ 341.449008] ? syscall_return_slowpath+0x5f0/0x5f0 [ 341.453948] ? prepare_exit_to_usermode+0x232/0x3b0 [ 341.458975] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 341.463829] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 341.469800] RIP: 0033:0x457ec9 [ 341.472994] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 341.491897] RSP: 002b:00007fd492df2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 341.499610] RAX: ffffffffffffffda RBX: 00007fd492df2c90 RCX: 0000000000457ec9 [ 341.506874] RDX: 0000000005000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 341.514140] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 341.521406] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd492df36d4 [ 341.528676] R13: 00000000004c4e48 R14: 00000000004d8770 R15: 0000000000000004 01:47:21 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x1, 0x0) [ 341.568910] binder_alloc: binder_alloc_mmap_handler: 12533 20001000-20004000 already mapped failed -16 [ 341.659016] binder: BINDER_SET_CONTEXT_MGR already set [ 341.699673] binder: 12533:12534 ioctl 40046207 0 returned -16 01:47:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) [ 341.747357] binder_alloc: 12533: binder_alloc_buf, no vma [ 341.781641] binder: 12533:12542 transaction failed 29189/-3, size 0-0 line 3035 [ 341.794063] binder: send failed reply for transaction 137 to 12533:12534 [ 341.808748] binder: undelivered TRANSACTION_COMPLETE [ 341.852544] binder: undelivered TRANSACTION_ERROR: 29189 [ 341.913194] binder: undelivered TRANSACTION_ERROR: 29189 01:47:22 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[]}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4), 0xc) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[@ANYBLOB="348bfe02197149d781000000", @ANYRES16=r2, @ANYBLOB="00012dbd7000fedbdf25010000000000000001410000001800170000001a000000157564703a73797a3100000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0xf641c1839fc06069) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'veth0\x00', &(0x7f0000000040)=@ethtool_sset_info={0x37, 0x0, 0xfffffffffffffffd}}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r1, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000002}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xec, r3, 0xd, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x10, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_LINK={0x48, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}]}]}, @TIPC_NLA_LINK={0x80, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40000}, 0x40800) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 01:47:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x1, 0x0) 01:47:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:22 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000001000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x5452, &(0x7f0000000000)={0x9, 0x0, 0x0, 0x0, '\xdd\xfb\xe3m\xe3\xf9\xb5\xe3\xe0\x04\xbc\xc0\xaeM\xe5\xd4\xe81\xc6\x8bl)V\xc2\x87Dv\xee\x83\xe4\x17EOhL\xabjq\xb19dN\xa9z'}) r1 = accept$inet(0xffffffffffffff9c, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000080)=0x10) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f00000000c0)={0x0, 0x3, 0x4, 0x101}) 01:47:22 executing program 0 (fault-call:6 fault-nth:1): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:22 executing program 5: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@dev={[], 0x1e}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x43, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x4, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x19ff, 0x0, 0x8}}}}}, 0x0) [ 342.145854] binder_alloc: binder_alloc_mmap_handler: 12553 20001000-20004000 already mapped failed -16 [ 342.190254] binder: BINDER_SET_CONTEXT_MGR already set 01:47:22 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:22 executing program 5: prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x4000, 0x0) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000280)=[0x100, 0x3]) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) ioctl$sock_FIOGETOWN(r0, 0x8903, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='scalable\x00', 0x9) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x20000, 0x0) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000140)={0x3, 0x9}, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, 0x0, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f00000000c0)={0x25, 0x3, 0x0, {0x5, 0x4, 0x0, 'bbr\x00'}}, 0x25) syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x7, 0x4000) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) [ 342.218998] binder: 12553:12554 ioctl 40046207 0 returned -16 [ 342.221004] binder_alloc: 12553: binder_alloc_buf, no vma 01:47:22 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) 01:47:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 342.291866] binder: release 12553:12554 transaction 140 out, still active [ 342.305648] binder: 12553:12572 transaction failed 29189/-3, size 0-0 line 3035 [ 342.316776] binder: send failed reply for transaction 140, target dead [ 342.372954] FAULT_INJECTION: forcing a failure. [ 342.372954] name failslab, interval 1, probability 0, space 0, times 0 [ 342.406726] CPU: 1 PID: 12582 Comm: syz-executor0 Not tainted 5.0.0-rc1+ #15 [ 342.413940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 342.423299] Call Trace: [ 342.425907] dump_stack+0x1db/0x2d0 [ 342.429563] ? dump_stack_print_info.cold+0x20/0x20 [ 342.434606] ? save_stack+0x45/0xd0 [ 342.438241] ? kasan_kmalloc+0xcf/0xe0 [ 342.442132] ? kasan_slab_alloc+0xf/0x20 [ 342.446208] ? kmem_cache_alloc_node+0x144/0x710 [ 342.450973] ? __alloc_skb+0xf4/0x730 [ 342.454783] ? sock_zerocopy_alloc+0xa5/0x3b0 [ 342.459302] should_fail.cold+0xa/0x15 [ 342.463206] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 342.468320] ? ___might_sleep+0x1e7/0x310 [ 342.472482] ? arch_local_save_flags+0x50/0x50 [ 342.477077] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.482617] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.488170] __should_failslab+0x121/0x190 [ 342.492419] should_failslab+0x9/0x14 [ 342.496229] kmem_cache_alloc_node_trace+0x270/0x720 [ 342.501350] ? __alloc_skb+0xf4/0x730 [ 342.505172] __kmalloc_node_track_caller+0x3d/0x70 [ 342.510119] __kmalloc_reserve.isra.0+0x40/0xe0 [ 342.514807] __alloc_skb+0x12d/0x730 [ 342.518543] ? skb_scrub_packet+0x440/0x440 [ 342.522874] ? __lock_acquire+0x572/0x4a30 [ 342.527119] ? mark_held_locks+0x100/0x100 [ 342.531361] ? check_noncircular+0x20/0x20 [ 342.535606] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.541159] sock_omalloc+0x153/0x280 [ 342.541180] ? __sock_wfree+0xc0/0xc0 [ 342.541200] ? print_usage_bug+0xd0/0xd0 [ 342.541222] sock_zerocopy_alloc+0xa5/0x3b0 [ 342.541240] ? kfree_skb_list+0x60/0x60 [ 342.548832] ? __lock_acquire+0x572/0x4a30 [ 342.548848] ? mark_held_locks+0x100/0x100 [ 342.548869] sock_zerocopy_realloc+0x32c/0x640 [ 342.548891] ? sock_zerocopy_alloc+0x3b0/0x3b0 [ 342.548908] ? mark_held_locks+0x100/0x100 [ 342.548926] ? __lock_acquire+0x572/0x4a30 [ 342.548947] __ip_append_data.isra.0+0x15d1/0x3350 [ 342.557310] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 342.557333] ? ip_reply_glue_bits+0xc0/0xc0 [ 342.557359] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.557378] ? __ip_flush_pending_frames.isra.0+0x2d0/0x2d0 [ 342.601882] ? find_held_lock+0x35/0x120 [ 342.601901] ? sk_dst_check+0x3a7/0x760 [ 342.601920] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.601943] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 342.632231] ? ip_setup_cork+0x53b/0x870 [ 342.636307] ip_make_skb+0x2b8/0x350 [ 342.636326] ? ip_reply_glue_bits+0xc0/0xc0 [ 342.636343] ? ip_flush_pending_frames+0x30/0x30 [ 342.649108] ? sk_dst_check+0x488/0x760 [ 342.653097] ? sock_def_write_space+0x990/0x990 [ 342.657781] udp_sendmsg+0x28b5/0x3a40 [ 342.661685] ? ip_reply_glue_bits+0xc0/0xc0 [ 342.666025] ? udp4_lib_lookup_skb+0x440/0x440 [ 342.670633] ? ___might_sleep+0x1e7/0x310 [ 342.674789] ? arch_local_save_flags+0x50/0x50 [ 342.679384] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 342.679409] ? __might_sleep+0x95/0x190 [ 342.679429] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 342.679445] ? aa_sk_perm+0x234/0x8e0 [ 342.679467] ? aa_af_perm+0x5d0/0x5d0 [ 342.679480] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 342.679504] inet_sendmsg+0x1af/0x740 [ 342.679517] ? udp4_lib_lookup_skb+0x440/0x440 [ 342.679541] ? inet_sendmsg+0x1af/0x740 [ 342.679562] ? ipip_gro_receive+0x100/0x100 [ 342.706577] ? apparmor_socket_sendmsg+0x2a/0x30 [ 342.706595] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 342.706612] ? security_socket_sendmsg+0x93/0xc0 [ 342.706630] ? ipip_gro_receive+0x100/0x100 [ 342.706648] sock_sendmsg+0xdd/0x130 [ 342.746327] ___sys_sendmsg+0x7ec/0x910 [ 342.746352] ? copy_msghdr_from_user+0x570/0x570 [ 342.746368] ? iterate_fd+0x4b0/0x4b0 [ 342.746397] ? lock_downgrade+0x910/0x910 [ 342.763061] ? __fget_light+0x2db/0x420 [ 342.767049] ? fget_raw+0x20/0x20 [ 342.770518] ? __mutex_unlock_slowpath+0x195/0x870 [ 342.775475] ? wait_for_completion+0x810/0x810 [ 342.780074] ? __fdget+0x1b/0x20 [ 342.783442] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 342.788983] ? sockfd_lookup_light+0xc2/0x160 [ 342.793484] __sys_sendmsg+0x112/0x270 [ 342.797378] ? __ia32_sys_shutdown+0x80/0x80 [ 342.801803] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 342.807173] ? trace_hardirqs_off_caller+0x300/0x300 [ 342.812280] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 342.817049] __x64_sys_sendmsg+0x78/0xb0 [ 342.821119] do_syscall_64+0x1a3/0x800 [ 342.825010] ? syscall_return_slowpath+0x5f0/0x5f0 [ 342.829955] ? prepare_exit_to_usermode+0x232/0x3b0 [ 342.834980] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 342.839833] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 342.845023] RIP: 0033:0x457ec9 [ 342.848224] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 342.867229] RSP: 002b:00007fd492df2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 01:47:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000015c0)=@ipv6_delroute={0x2c, 0x19, 0x511, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a00}, [@RTA_EXPIRES={0x8}, @RTA_IIF={0x8}]}, 0x2c}}, 0x0) mlockall(0x4) 01:47:22 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:22 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) 01:47:22 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 342.874940] RAX: ffffffffffffffda RBX: 00007fd492df2c90 RCX: 0000000000457ec9 [ 342.882211] RDX: 0000000005000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 342.889480] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 342.896746] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd492df36d4 [ 342.904015] R13: 00000000004c4e48 R14: 00000000004d8770 R15: 0000000000000004 [ 342.917659] binder: BINDER_SET_CONTEXT_MGR already set [ 342.946326] binder: 12586:12594 ioctl 40046207 200002c0 returned -16 [ 343.007224] binder_alloc: binder_alloc_mmap_handler: 12586 20001000-20004000 already mapped failed -16 [ 343.051293] binder: BINDER_SET_CONTEXT_MGR already set [ 343.073750] binder: 12586:12594 ioctl 40046207 0 returned -16 [ 343.073780] binder_alloc: 12586: binder_alloc_buf, no vma [ 343.085975] binder: 12586:12604 transaction failed 29189/-3, size 0-0 line 3035 [ 343.102765] binder: BINDER_SET_CONTEXT_MGR already set 01:47:23 executing program 0 (fault-call:6 fault-nth:2): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:23 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:23 executing program 4: r0 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000140)) r1 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r1, &(0x7f0000001540)={&(0x7f0000000000)=@in={0x2, 0x0, @dev}, 0x10, &(0x7f0000001440)=[{&(0x7f0000000040)='I', 0x1}], 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000284000000070000007f000001000000002000000000000000848521967f00000008e000000000000000000000000000005e6fe718d8e6fd2be02090ec7b94ab6073bf2b0f118177b25a07f469dc333732d833fbbc0dcced118a819cba044378fee0"], 0x38}, 0x4810) 01:47:23 executing program 3: syz_emit_ethernet(0x0, 0x0, 0x0) [ 343.125559] binder: release 12586:12594 transaction 143 out, still active [ 343.135706] binder: 12586:12600 ioctl 40046207 200002c0 returned -16 [ 343.149694] binder_release_work: 1 callbacks suppressed [ 343.149700] binder: undelivered TRANSACTION_COMPLETE 01:47:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 343.223198] binder_release_work: 1 callbacks suppressed [ 343.223204] binder: undelivered TRANSACTION_ERROR: 29189 [ 343.258320] binder: send failed reply for transaction 143, target dead [ 343.364858] binder: release 12622:12624 transaction 146 out, still active [ 343.395002] binder: undelivered TRANSACTION_COMPLETE [ 343.405648] binder_alloc: binder_alloc_mmap_handler: 12622 20001000-20004000 already mapped failed -16 [ 343.419615] binder: BINDER_SET_CONTEXT_MGR already set [ 343.425084] binder: 12622:12624 ioctl 40046207 0 returned -16 [ 343.437625] binder_alloc: 12622: binder_alloc_buf, no vma [ 343.444779] binder: 12622:12625 transaction failed 29189/-3, size 0-0 line 3035 [ 343.458409] binder: send failed reply for transaction 146, target dead [ 343.468181] binder: undelivered TRANSACTION_ERROR: 29189 01:47:23 executing program 5: prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x4000, 0x0) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000280)=[0x100, 0x3]) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000680)={0x2, 0x4e23, @local}, 0x10) ioctl$sock_FIOGETOWN(r0, 0x8903, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='scalable\x00', 0x9) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x20000, 0x0) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000140)={0x3, 0x9}, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, 0x0, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f00000000c0)={0x25, 0x3, 0x0, {0x5, 0x4, 0x0, 'bbr\x00'}}, 0x25) syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x7, 0x4000) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) 01:47:23 executing program 4: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, r1, 0xe22, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x100}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SOCKETS={0x14, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r0}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3f5ca7f2}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x81}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xf46}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x8}]}, 0x84}, 0x1, 0x0, 0x0, 0x8040}, 0x4000) setns(r0, 0x10020000) 01:47:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x0, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:23 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:23 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x0, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000042c0)={&(0x7f0000000b40)=@newlink={0x38, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x18, 0x12, @ip6gretap={{0x10, 0x1, 'ip6gretap\x00'}, {0x4}}}]}, 0x38}}, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x100, 0x0) mq_getsetattr(r2, &(0x7f0000000080)={0x6, 0xffffffffffff3279, 0x2, 0xdc2a, 0x4, 0x4, 0x9, 0x1}, &(0x7f0000000100)) [ 343.689225] binder_alloc: binder_alloc_mmap_handler: 12631 20001000-20004000 already mapped failed -16 01:47:24 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x0, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:24 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x1000000, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 343.767683] binder: BINDER_SET_CONTEXT_MGR already set 01:47:24 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:24 executing program 3: syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x8, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request}}}}}, 0x0) [ 343.818773] binder: 12631:12639 ioctl 40046207 0 returned -16 [ 343.847669] binder_alloc: 12631: binder_alloc_buf, no vma [ 343.897076] binder: send failed reply for transaction 149 to 12631:12639 [ 343.955265] binder: undelivered TRANSACTION_COMPLETE [ 343.975668] binder: 12631:12656 transaction failed 29189/-3, size 0-0 line 3035 [ 343.980237] binder: undelivered TRANSACTION_ERROR: 29189 [ 344.010992] binder: undelivered TRANSACTION_ERROR: 29189 01:47:24 executing program 5: r0 = semget$private(0x0, 0x7, 0x0) semop(r0, &(0x7f00000000c0)=[{0x0, 0x80}, {}], 0x2) semctl$GETZCNT(r0, 0x4, 0xf, &(0x7f0000000000)=""/9) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x260000, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000240)={&(0x7f0000000180)=[0x0], 0x3ffffffffffffeac}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40000, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000280)=0x1) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x20000, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e22, 0x2f, @remote, 0x3}, @in6={0xa, 0x4e22, 0x62, @local, 0x10000}, @in6={0xa, 0x4e23, 0x2, @dev={0xfe, 0x80, [], 0x25}, 0xa75}, @in6={0xa, 0x4e20, 0x1f, @dev={0xfe, 0x80, [], 0x11}, 0x1}], 0x70) 01:47:24 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f00000000c0)=r2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000240)={{{@in6=@mcast2, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6}}, &(0x7f0000000100)=0xe8) r6 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$get_persistent(0x16, r5, r6) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000080)=0x32, 0x4) connect$inet(r4, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000380)='/dev/sequencer\x00', 0x4000, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r7, 0x10e, 0x5, &(0x7f00000003c0)=0xffffffff, 0x4) ioctl$sock_ifreq(r3, 0x8924, &(0x7f0000000200)={'bond0\x00\x00\x00\x00\x06\x00\x00\x01\x00', @ifru_mtu=0x80000001}) setsockopt$inet_int(r4, 0x0, 0x400000004, &(0x7f0000000040)=0x4, 0x4) 01:47:24 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0xffffff7f, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:24 executing program 3: syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x8, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request}}}}}, 0x0) 01:47:24 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 344.539804] binder_alloc: binder_alloc_mmap_handler: 12670 20001000-20004000 already mapped failed -16 01:47:24 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = fcntl$getown(r0, 0x9) syz_open_procfs$namespace(r2, &(0x7f0000000000)='ns/net\x00') r3 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x8001, 0x181002) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r3, &(0x7f0000000240)="3cda7e25e62870b2d555315d8b620729af0ec50a4c8ea236150b1249c053d3bb9a34f86fc34f3ead0ef82f83611ba9130a90f3a6ba0632dfdee949fda1a872aa57635d4593b1e5490ed02e5384c5560404eb00e3b225f9a81fa11a9156a693a91e1b99d35176ab3d69d3fe5058bfb77a9588b412a84d58c19b683e693e731a9feed7fc19938820e8096cdb357f5eb491f21d902b4686d571aeeb25a93991ea5bc68afebfd28925abfeeb2967012903560553d8417be9ba", &(0x7f00000001c0)=""/15}, 0x18) r4 = getpid() socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000140)) rt_tgsigqueueinfo(r4, r4, 0x16, &(0x7f00000000c0)) ptrace(0x10, r4) ptrace$getregset(0x4209, r4, 0xa05000, 0x0) bind$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @hyper}, 0x10) getsockname$packet(r3, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') [ 344.588108] binder: BINDER_SET_CONTEXT_MGR already set 01:47:24 executing program 3: syz_emit_ethernet(0x3e, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x8, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request}}}}}, 0x0) 01:47:24 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x100000000000000, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 344.611714] binder: 12670:12677 ioctl 40046207 0 returned -16 [ 344.615622] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 344.615622] The task syz-executor5 (12687) triggered the difference, watch for misbehavior. [ 344.635900] binder_alloc: 12670: binder_alloc_buf, no vma 01:47:24 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x102) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000500)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10010174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b19eeb299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c888c9ff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4048ae9b, &(0x7f0000000480)={0x80ffff}) dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 01:47:24 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 344.705522] binder: send failed reply for transaction 152 to 12670:12677 [ 344.725586] binder: 12670:12689 transaction failed 29189/-3, size 0-0 line 3035 [ 344.735006] binder: undelivered TRANSACTION_COMPLETE 01:47:25 executing program 3: syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x14, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45"}}}}}}, 0x0) [ 344.755279] binder: undelivered TRANSACTION_ERROR: 29189 [ 344.783807] binder: undelivered TRANSACTION_ERROR: 29189 01:47:25 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0xffffff7f00000000, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:25 executing program 3: syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x14, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45"}}}}}}, 0x0) 01:47:25 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:25 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") getsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000180), &(0x7f00000001c0)=0x4) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400000, 0x0) write$9p(r2, &(0x7f0000000100)="2a552d8792ac517341f897b9a260ffa20b7586cae6bfa40ba286f04247fe513a81da58536ee2368f5753a8780795bbaeb8b605b69a0af3d19d842a02", 0x3c) listen(r0, 0x5) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000001c00)={0x323a}, 0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x5, 0x25c}, &(0x7f0000000040)=0x18) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000080)={r3, 0x5, 0x99, 0x9, 0x3ff, 0x10001}, 0x14) r4 = socket$inet6_sctp(0xa, 0xfffffffffffffffd, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x2, @loopback}], 0x1c) r5 = syz_open_dev$sndpcmp(&(0x7f0000000200)='/dev/snd/pcmC#D#p\x00', 0x8569, 0x444100) ioctl$RTC_UIE_OFF(r5, 0x7004) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000240)) 01:47:25 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x100000000000000, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:25 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) socketpair(0x0, 0x0, 0x40, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$rds(r1, &(0x7f0000000b40)={&(0x7f00000002c0)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f00000005c0)=[{&(0x7f00000004c0)=""/231, 0xe7}], 0x1, &(0x7f0000000a00)=ANY=[@ANYBLOB="0100000000000000c600000000000000000000000000000008000000000000003900000000000000000000000000000018000000000000001401000002000000030000000900"], 0x46, 0x800}, 0x48001) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0d00000000005f3206fa545d37d72464c0e1182d761324f766e0acacd68d992390ba9ecb17fd4c1997b580ad3d48e67b0d0000000000000099b50fb9d52f41f675c9802c7b6bff4bdbdee7fd8dc865883bc1e64945fd6abbe588ee70fe57c46634735a934f3b33ce04f275abcd4e18ead6c341de760baddb89c13e01c43ee599075bb05e8527df5a1a097fe54f414c7531f51c78c5b332532c42a7c8193c08e5a0ea973fef75a727acf8ec6828d0514ae8fa9c78ecb174e11e3c856fc652c796cac8a4e108248d2d00ec8b5d351bc727ed33056a4fd71e9234627260aa1924aaa57cba68180b7ae84a0d44fd6ef407a66cf771fa12f2376c65f74c9d15ce9247b2e09eacd4d84bf49a0e3ef70e52fad9a2f44050add2185a079347fd3f35e9c4"], 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, 0x0, &(0x7f00000013c0)) r3 = openat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000007c0)='TIPC\x00') r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x7) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000780)={0x0, 0x3}, &(0x7f0000000800)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000840)={r6, 0x4}, &(0x7f0000000880)=0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x20000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCSMASK(r5, 0x40104593, &(0x7f0000000300)={0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000380)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0xc204, &(0x7f0000000000)) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000440)=0x66, 0x4) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x8d6}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000200)=r7, 0x4) getsockname$unix(r2, &(0x7f00000003c0), 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000600)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@empty}}, &(0x7f0000000480)=0xe8) r9 = add_key$keyring(&(0x7f0000000700)='keyring\x00', &(0x7f0000000740)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$get_persistent(0x16, r8, r9) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) 01:47:25 executing program 3: syz_emit_ethernet(0x4a, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x14, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45"}}}}}}, 0x0) [ 345.422893] binder_alloc: binder_alloc_mmap_handler: 12727 20001000-20004000 already mapped failed -16 01:47:25 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 345.479595] binder: BINDER_SET_CONTEXT_MGR already set 01:47:25 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:25 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = perf_event_open(&(0x7f00004e7000)={0x2, 0x70, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x0) [ 345.531652] binder: 12727:12730 ioctl 40046207 0 returned -16 [ 345.533974] binder_alloc: 12727: binder_alloc_buf, no vma [ 345.605971] binder: send failed reply for transaction 155 to 12727:12730 [ 345.643273] binder: undelivered TRANSACTION_COMPLETE [ 345.666626] binder: undelivered TRANSACTION_ERROR: 29189 [ 345.698782] binder: 12727:12743 transaction failed 29189/-3, size 0-0 line 3035 01:47:25 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:25 executing program 3: syz_emit_ethernet(0x50, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1a, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e88"}}}}}}, 0x0) [ 345.754113] binder: undelivered TRANSACTION_ERROR: 29189 01:47:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:26 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x40, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f0000000440)={0x8, 0x5, 0x0, 0x5, &(0x7f0000000300)=[{}, {}, {}, {}, {}]}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5000000013001103000000000000000000000000c9649c33727d2b24c8d9aaf3aa49f0f05b0825b11fc3c5ffcd69e386fc61259221510eee4bbb3af3c29363728e08062c74d03179fb154ba671458b", @ANYRES32=0x0, @ANYBLOB="000000000000000008000d00000000001400280076657468305f746f5f7465616d000000140003007465616d5f736c6176655f3100000000"], 0x50}}, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x3, 0xe00) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000100)) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x400, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f00000001c0)=""/115) 01:47:26 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:26 executing program 3: syz_emit_ethernet(0x50, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1a, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e88"}}}}}}, 0x0) [ 345.866189] netlink: 48 bytes leftover after parsing attributes in process `syz-executor5'. [ 345.949856] binder_alloc: binder_alloc_mmap_handler: 12772 20001000-20004000 already mapped failed -16 [ 345.965237] netlink: 48 bytes leftover after parsing attributes in process `syz-executor5'. [ 346.005799] binder: BINDER_SET_CONTEXT_MGR already set 01:47:26 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) socketpair(0x0, 0x0, 0x40, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) sendmsg$rds(r1, &(0x7f0000000b40)={&(0x7f00000002c0)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f00000005c0)=[{&(0x7f00000004c0)=""/231, 0xe7}], 0x1, &(0x7f0000000a00)=ANY=[@ANYBLOB="0100000000000000c600000000000000000000000000000008000000000000003900000000000000000000000000000018000000000000001401000002000000030000000900"], 0x46, 0x800}, 0x48001) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000b80)=ANY=[@ANYBLOB="0d00000000005f3206fa545d37d72464c0e1182d761324f766e0acacd68d992390ba9ecb17fd4c1997b580ad3d48e67b0d0000000000000099b50fb9d52f41f675c9802c7b6bff4bdbdee7fd8dc865883bc1e64945fd6abbe588ee70fe57c46634735a934f3b33ce04f275abcd4e18ead6c341de760baddb89c13e01c43ee599075bb05e8527df5a1a097fe54f414c7531f51c78c5b332532c42a7c8193c08e5a0ea973fef75a727acf8ec6828d0514ae8fa9c78ecb174e11e3c856fc652c796cac8a4e108248d2d00ec8b5d351bc727ed33056a4fd71e9234627260aa1924aaa57cba68180b7ae84a0d44fd6ef407a66cf771fa12f2376c65f74c9d15ce9247b2e09eacd4d84bf49a0e3ef70e52fad9a2f44050add2185a079347fd3f35e9c4"], 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, 0x0, &(0x7f00000013c0)) r3 = openat(0xffffffffffffff9c, &(0x7f0000001380)='./file0\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000007c0)='TIPC\x00') r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x7) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000780)={0x0, 0x3}, &(0x7f0000000800)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000840)={r6, 0x4}, &(0x7f0000000880)=0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x20000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EVIOCSMASK(r5, 0x40104593, &(0x7f0000000300)={0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000380)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0xc204, &(0x7f0000000000)) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000440)=0x66, 0x4) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x8d6}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000200)=r7, 0x4) getsockname$unix(r2, &(0x7f00000003c0), 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000600)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@empty}}, &(0x7f0000000480)=0xe8) r9 = add_key$keyring(&(0x7f0000000700)='keyring\x00', &(0x7f0000000740)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$get_persistent(0x16, r8, r9) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) [ 346.028827] binder: 12772:12774 ioctl 40046207 0 returned -16 [ 346.044344] binder_alloc: 12772: binder_alloc_buf, no vma [ 346.056819] binder: 12772:12785 transaction failed 29189/-3, size 0-0 line 3035 [ 346.083303] binder: release 12772:12774 transaction 158 out, still active [ 346.092942] binder: undelivered TRANSACTION_COMPLETE [ 346.116086] binder: undelivered TRANSACTION_ERROR: 29189 01:47:26 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:26 executing program 3: syz_emit_ethernet(0x50, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1a, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e88"}}}}}}, 0x0) 01:47:26 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x87, 0x0, 0x0, 0x0, 0xce, 0x800, 0x6446, 0x3, 0x0}, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0x2}, &(0x7f0000000180)=0x8) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'veth1_to_team\x00', 0x8}, 0x18) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000240)=ANY=[@ANYBLOB="64000000764d0b8081e9fbcb75beddce62393fd2a9844cde0e60037882c0dee167422e83648cfda8600429f6cd2900000000e5053b20d00cecb94791b0a62db3419daf98caabf643552b89ac06c955932ba74704b15886f8b2"], 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000002a80)={&(0x7f0000000080)=@in={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f00000027c0), 0x0, &(0x7f00000029c0)}, 0x800) ioctl(r0, 0x8916, &(0x7f0000000000)) syz_genetlink_get_family_id$team(&(0x7f0000001580)='team\x00') getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000015c0)={@local, @multicast1}, &(0x7f0000001600)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001640)={'erspan0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001680)={'vcan0\x00'}) getpeername$packet(r0, &(0x7f0000001bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) accept4$packet(r0, &(0x7f0000002200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002240)=0x14, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000002280)={{{@in, @in=@local}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000002380)=0xe8) getpeername$packet(r0, &(0x7f00000023c0), &(0x7f0000002400)=0x14) getpeername$packet(r0, &(0x7f0000002440), &(0x7f0000002480)=0x14) recvmsg$kcm(r0, &(0x7f0000002800)={&(0x7f00000024c0)=@xdp, 0x80, &(0x7f0000002780)=[{&(0x7f0000002540)=""/227, 0xe3}, {&(0x7f0000006cc0)=""/4096, 0x1000}, {&(0x7f0000002640)=""/57, 0x39}, {&(0x7f0000002680)=""/251, 0xfb}], 0x4, &(0x7f00000027c0)=""/18, 0x12, 0x4}, 0x21) accept4$packet(r0, &(0x7f0000002840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002880)=0x14, 0x0) getpeername$packet(r0, &(0x7f00000028c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000002900)=0xfffffea3) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000005c0)={{{@in6=@mcast1, @in6}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f0000000100)=0x92) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000002b00)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x20200}, 0xc, &(0x7f0000002ac0)={&(0x7f0000000500)=ANY=[@ANYBLOB="08090000000000003a9f2068d281a31f6123f7231fc2ee550f5f133d7ab63f58f6f6e0926117d2e77b7d7084c122ceed56814923a39174e28749bf411ccb5c4c01c4c5610eb546b47ba1e279d00be6f5a04e8d75aba1dc2864d72670d5302548901688058919c0b572e6f83e3efcc8ace7a6ccc869cfa61d52a24cc2abc58f39f9577d5a1a2acd7101db36853398a3dcd90ae2acacea431398f6ee33"], 0x1}, 0x1, 0x0, 0x0, 0x20040010}, 0xc010) r2 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x100, 0x0) r3 = open(&(0x7f0000000040)='./bus\x00', 0x141048, 0x0) close(r3) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x40000003, 0x10507e) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000000400)=[0x7, 0x81]) bind$inet(r4, &(0x7f0000e5b000)={0x2, 0x2004e20}, 0x10) connect$inet(r4, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x3, &(0x7f00009ff000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}}, &(0x7f00002bf000)='syzkaller\x00', 0x1, 0xb7, &(0x7f0000000440)=""/183}, 0x48) r6 = socket$kcm(0x29, 0x1000000000002, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f000031aff8)={r4, r5}) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$TCSETA(r2, 0x5406, &(0x7f0000001500)={0x1, 0x3, 0x3, 0xffff, 0x4, 0x1f}) ftruncate(0xffffffffffffffff, 0x4) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000017c0)={{{@in6=@dev, @in=@remote}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000000300)=0x5e) close(r6) close(r7) [ 346.139162] binder: send failed reply for transaction 158, target dead [ 346.211084] binder_alloc: binder_alloc_mmap_handler: 12798 20001000-20004000 already mapped failed -16 01:47:26 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 346.260674] binder: BINDER_SET_CONTEXT_MGR already set 01:47:26 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 346.297432] binder: 12798:12799 ioctl 40046207 0 returned -16 [ 346.320921] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 346.331405] binder_alloc: 12798: binder_alloc_buf, no vma [ 346.388841] binder: release 12798:12799 transaction 161 out, still active [ 346.395934] binder: undelivered TRANSACTION_COMPLETE [ 346.402076] binder: 12798:12807 transaction failed 29189/-3, size 0-0 line 3035 [ 346.432731] binder: send failed reply for transaction 161, target dead [ 346.468751] binder: undelivered TRANSACTION_ERROR: 29189 01:47:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:26 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:26 executing program 3: syz_emit_ethernet(0x53, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1d, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f1"}}}}}}, 0x0) 01:47:26 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x2}}, 0x5000000) [ 346.629341] binder_alloc: binder_alloc_mmap_handler: 12825 20001000-20004000 already mapped failed -16 [ 346.716073] binder: BINDER_SET_CONTEXT_MGR already set [ 346.753795] binder: 12825:12827 ioctl 40046207 0 returned -16 [ 346.766639] binder: release 12825:12827 transaction 164 out, still active [ 346.772279] binder_alloc: 12825: binder_alloc_buf, no vma [ 346.774329] binder: undelivered TRANSACTION_COMPLETE [ 346.786437] binder: 12825:12830 transaction failed 29189/-3, size 0-0 line 3035 [ 346.807090] binder: send failed reply for transaction 164, target dead 01:47:27 executing program 4: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x8001, 0x200) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000300)={'rose0\x00', 0x400}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r3 = open(&(0x7f0000000080)='./file0\x00', 0x100, 0x4) readv(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x20000643}], 0x1000000000000156) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x3) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f0000000340)=ANY=[@ANYBLOB="66697a74657200000000000000000000000000000000000000000000000000000000080060df21d1b77ce516f991ef4da744c8bb726ab56067cd5134bef80158c800862b5f05b39c44fcb84f2554afdd49f6147eb538104a050a65fc044da1c11c808c41544892313c8423b8ed7335006aec3210fee36c7245d74ba8abf1c8cdbe6f0dddc0ce30527450d3"], &(0x7f0000000400)=0x90) ioctl$TCSETS(r2, 0x40045431, &(0x7f00000001c0)={0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x3, 0x80000001, 0x4}) r4 = syz_open_pts(r2, 0x2) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000440)={0x6, 0x1, 0x3db, 0xc22, 0x4469d550}, 0xc) dup3(r4, r2, 0x0) write(r2, &(0x7f0000c34fff), 0xffffff0b) semget(0x2, 0x4, 0x200) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, 0x0) 01:47:27 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="32cae4783d32"}, 0xffffffde) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0xc00, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f00000000c0)={{0x3c, @local, 0x4e20, 0x3, 'fo\x00', 0x10, 0xdc, 0xb}, {@remote, 0x4e20, 0x4, 0x1, 0xfffffffffffffffa, 0xc0000000000000}}, 0x44) sendto$inet6(r0, &(0x7f0000000180)="040300000100baffffff00000800", 0xe, 0x0, 0x0, 0x0) 01:47:27 executing program 3: syz_emit_ethernet(0x53, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1d, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f1"}}}}}}, 0x0) 01:47:27 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto(0xffffffffffffffff, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:27 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x8}}, 0x5000000) 01:47:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 347.030178] binder: 12841 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 347.030191] binder: 12841:12843 ioctl c018620c 200002c0 returned -22 01:47:27 executing program 3: syz_emit_ethernet(0x53, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1d, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f1"}}}}}}, 0x0) 01:47:27 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) epoll_create1(0x800000280000) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x101000, 0x0) 01:47:27 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x300}}, 0x5000000) [ 347.151960] binder_alloc: binder_alloc_mmap_handler: 12841 20001000-20004000 already mapped failed -16 [ 347.197273] binder: BINDER_SET_CONTEXT_MGR already set 01:47:27 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto(0xffffffffffffffff, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:27 executing program 4: r0 = socket$inet6(0xa, 0xffffffffffffffff, 0x200) delete_module(&(0x7f0000000000)='#\x00', 0xa00) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="0e0000000000000000000000000000000000000200000000000000000000000000000000000000000000000054d381d168ab4679292d67da6a3ed9eb0957272a18fcbedfe756ac3ede62844517e8f04c2d9a6fc9a06768eb5387db3ba7c5cc7c5bd5355e3c4f0782f944a18251adfcadbffda1ef53931bdf5cfae1662cdd7aa136ecf64a672bc60adaa64a419b80ca83fd2f30d0b8f7e479d6cf2eb8c3dc36b1a8e085c4c153e3aa1cefc400ba7bd0d6bbb2f45dcd6bdce4da370e7799eb30a636669a61eb699f26ae9807f64cef03000000000000000000"]}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) 01:47:27 executing program 3: syz_emit_ethernet(0x54, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1e, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a"}}}}}}, 0x0) [ 347.250548] binder: 12841:12843 ioctl 40046207 0 returned -16 01:47:27 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x7e) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r0, &(0x7f0000000540), 0x40000000000022b, 0x20007ffc) ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, 0x0) ioctl$TIOCLINUX6(0xffffffffffffffff, 0x541c, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) 01:47:27 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x200004c1}}, 0x5000000) [ 347.329529] binder: send failed reply for transaction 167 to 12841:12843 [ 347.343318] binder: undelivered TRANSACTION_COMPLETE 01:47:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:27 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000040)={@dev, 0x0}, &(0x7f0000000080)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000000c0)={@ipv4={[], [], @broadcast}, r1}, 0x14) ioctl(r0, 0x20000000008912, &(0x7f0000000000)="0a5c2d0240316285717070") mbind(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0xc003, 0x0, 0x0, 0x0) 01:47:27 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto(0xffffffffffffffff, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:27 executing program 3: syz_emit_ethernet(0x54, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1e, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a"}}}}}}, 0x0) 01:47:27 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x7ffff000}}, 0x5000000) [ 347.558814] binder_alloc: binder_alloc_mmap_handler: 12889 20001000-20004000 already mapped failed -16 [ 347.593409] binder: BINDER_SET_CONTEXT_MGR already set 01:47:27 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240), &(0x7f00000002c0)=0x14) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000004c0), 0x0) ioctl$VHOST_GET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af14, &(0x7f0000000180)) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x0, 0x2) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000a80)) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000280)) listen(r1, 0x4) r3 = getpgrp(0x0) fcntl$lock(r0, 0x7, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0x2, r3}) r4 = dup2(r1, r1) socket$netlink(0x10, 0x3, 0x4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000600)=0x74) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000000)='/dev/amidi#\x00', 0xffffffffffffffff}, 0x30) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000680)={0x0, 0x9, 0x5171, 0x1, 0xffffffffffffffff, 0x8, 0x2, 0x1, {0x0, @in={{0x2, 0x4e20}}, 0x5, 0x7, 0xff, 0x9565, 0x9}}, &(0x7f0000000740)=0xb0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000780)=ANY=[], &(0x7f00000007c0)) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000002b40)={0x0, 0x58, &(0x7f0000002ac0)=[@in6={0xa, 0x4e20, 0x9, @empty, 0x5}, @in6={0xa, 0x4e23, 0x6a, @remote, 0xdd8f}, @in={0x2, 0x4e22, @rand_addr=0x6}, @in={0x2, 0x4e24, @multicast2}]}, &(0x7f0000002b80)=0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000002bc0)={0x0, 0x6}, &(0x7f0000002c00)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000003440)={0x0, 0x7, 0x9, 0x4}, &(0x7f0000003480)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f00000034c0)={0x0, @in={{0x2, 0x4e21, @multicast2}}, 0x8f3, 0x7}, &(0x7f0000003580)=0x90) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000380)=ANY=[@ANYRES32=r6, @ANYBLOB="2b000000fd8e8e983fe721ccacf083247767f2b5071b59f9b99f0ff5121b57b65226bd49a65032998931585e82000100000000"], &(0x7f0000003a40)=0x33) sendmmsg$inet_sctp(r4, &(0x7f0000003b00)=[{&(0x7f0000003680)=@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10, &(0x7f00000039c0)=[{&(0x7f0000003940)="f2d6ec35a9d5f1321ea5720cb9ae9ac9d75d4f7896486379d6431e3119ed432012707f113cd9b0275fb8384e2a16b54f1f3dd711b4775d4332970d61ea82ee0339a2bd92929bf6ebfe", 0x49}], 0x1, &(0x7f0000003a80), 0x0, 0x81}], 0x1, 0x400c840) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, &(0x7f00000001c0)) pipe2(&(0x7f0000000140), 0x800) sendto$inet6(r5, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = accept4(r1, 0x0, &(0x7f00000003c0), 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000300)=ANY=[@ANYRES32=0x0], &(0x7f0000000340)=0x1) dup3(r0, r7, 0x80000) 01:47:27 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, 0x0, 0x0, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:27 executing program 3: syz_emit_ethernet(0x54, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1e, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a"}}}}}}, 0x0) [ 347.652314] binder: 12889:12890 ioctl 40046207 0 returned -16 [ 347.675711] binder_alloc: 12889: binder_alloc_buf, no vma [ 347.739376] binder: 12889:12902 transaction failed 29189/-3, size 0-0 line 3035 [ 347.746987] binder: send failed reply for transaction 169 to 12889:12890 [ 347.783153] binder: undelivered TRANSACTION_COMPLETE 01:47:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:28 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x2}, 0x5000000) 01:47:28 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000580)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r1, &(0x7f0000008a00)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000000)=""/48, 0x33ff0}], 0x1}}], 0x1, 0x0, 0x0) 01:47:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, 0x0, 0x0, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:28 executing program 3 (fault-call:0 fault-nth:0): syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 348.058911] binder_alloc: binder_alloc_mmap_handler: 12918 20001000-20004000 already mapped failed -16 [ 348.131928] binder: BINDER_SET_CONTEXT_MGR already set 01:47:28 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x8}, 0x5000000) [ 348.198969] binder: 12918:12919 ioctl 40046207 0 returned -16 01:47:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, 0x0, 0x0, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 348.267237] binder_alloc: 12918: binder_alloc_buf, no vma [ 348.333835] FAULT_INJECTION: forcing a failure. [ 348.333835] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 348.355444] binder: 12918:12921 transaction failed 29189/-3, size 0-0 line 3035 [ 348.363196] CPU: 1 PID: 12937 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #15 [ 348.370395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 348.379754] Call Trace: [ 348.382359] dump_stack+0x1db/0x2d0 [ 348.386007] ? dump_stack_print_info.cold+0x20/0x20 [ 348.391050] ? print_usage_bug+0xd0/0xd0 [ 348.395132] should_fail.cold+0xa/0x15 [ 348.399034] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 348.404145] ? __lock_acquire+0x572/0x4a30 [ 348.404164] ? __lock_acquire+0x572/0x4a30 [ 348.404181] ? print_usage_bug+0xd0/0xd0 [ 348.404205] ? mark_held_locks+0x100/0x100 [ 348.404293] should_fail_alloc_page+0x50/0x60 [ 348.412679] __alloc_pages_nodemask+0x323/0xdc0 [ 348.412698] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 348.412715] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 348.412740] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 348.445382] ? add_lock_to_list.isra.0+0x450/0x450 [ 348.450327] ? lock_downgrade+0x910/0x910 [ 348.450345] ? kasan_check_read+0x11/0x20 [ 348.450364] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 348.450477] ? tun_build_skb.isra.0+0x277/0x1770 [ 348.450496] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 348.464080] alloc_pages_current+0x107/0x210 [ 348.464105] skb_page_frag_refill+0x434/0x680 [ 348.464127] ? sock_kfree_s+0x70/0x70 [ 348.483599] binder_release_work: 4 callbacks suppressed [ 348.483606] binder: undelivered TRANSACTION_ERROR: 29189 [ 348.487067] ? rcu_read_unlock_special+0x380/0x380 [ 348.487096] tun_build_skb.isra.0+0x2f8/0x1770 [ 348.507387] ? tun_chr_read_iter+0x1e0/0x1e0 [ 348.511811] ? __lock_acquire+0x572/0x4a30 [ 348.512161] binder: send failed reply for transaction 172 to 12918:12919 [ 348.516059] ? print_usage_bug+0xd0/0xd0 [ 348.516077] ? print_usage_bug+0xd0/0xd0 [ 348.516094] ? add_lock_to_list.isra.0+0x450/0x450 [ 348.516118] ? mark_held_locks+0x100/0x100 [ 348.516135] ? aa_file_perm+0x42e/0x1090 [ 348.516151] ? find_held_lock+0x35/0x120 [ 348.516166] ? aa_file_perm+0x42e/0x1090 [ 348.516183] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 348.557925] tun_get_user+0xbc9/0x4150 [ 348.561821] ? kasan_check_read+0x11/0x20 [ 348.565976] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 348.571263] ? add_lock_to_list.isra.0+0x450/0x450 [ 348.576212] ? tun_build_skb.isra.0+0x1770/0x1770 [ 348.581069] ? lock_downgrade+0x910/0x910 [ 348.585239] ? kasan_check_read+0x11/0x20 [ 348.589389] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 348.594667] ? rcu_read_unlock_special+0x380/0x380 [ 348.599609] ? tun_get+0x22e/0x380 [ 348.603151] ? tun_chr_close+0x180/0x180 [ 348.607215] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 348.612147] ? common_file_perm+0x231/0x800 [ 348.616479] tun_chr_write_iter+0xbd/0x160 [ 348.620724] do_iter_readv_writev+0x902/0xbc0 [ 348.625230] ? vfs_dedupe_file_range+0x780/0x780 [ 348.629988] ? apparmor_file_permission+0x25/0x30 [ 348.634832] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 348.640373] ? rw_verify_area+0x118/0x360 [ 348.644525] do_iter_write+0x184/0x610 [ 348.648487] ? dup_iter+0x260/0x260 [ 348.652126] ? lock_downgrade+0x910/0x910 [ 348.656282] vfs_writev+0x1ee/0x370 [ 348.659911] ? vfs_iter_write+0xb0/0xb0 [ 348.663891] ? kasan_check_write+0x14/0x20 [ 348.668128] ? __mutex_unlock_slowpath+0x195/0x870 [ 348.673070] ? wait_for_completion+0x810/0x810 [ 348.677657] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 348.683192] ? __fdget_pos+0xdc/0x1f0 [ 348.686992] ? __fdget_raw+0x20/0x20 [ 348.690708] ? __sb_end_write+0xd9/0x110 [ 348.694777] do_writev+0x11a/0x300 [ 348.698322] ? vfs_writev+0x370/0x370 [ 348.702127] ? trace_hardirqs_off_caller+0x300/0x300 [ 348.707231] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 348.711995] __x64_sys_writev+0x75/0xb0 [ 348.715973] do_syscall_64+0x1a3/0x800 [ 348.719862] ? syscall_return_slowpath+0x5f0/0x5f0 [ 348.724797] ? prepare_exit_to_usermode+0x232/0x3b0 [ 348.729823] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 348.734675] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 348.739865] RIP: 0033:0x457d81 [ 348.743068] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 b8 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 348.761966] RSP: 002b:00007f0c4765eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 348.769679] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 0000000000457d81 [ 348.776948] RDX: 0000000000000001 RSI: 00007f0c4765ebf0 RDI: 00000000000000f0 01:47:29 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x300}, 0x5000000) 01:47:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 348.784216] RBP: 0000000020000140 R08: 00000000000000f0 R09: 0000000000000000 [ 348.791481] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f0c4765f6d4 [ 348.798751] R13: 00000000004c636f R14: 00000000004db3f8 R15: 0000000000000003 01:47:29 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240), &(0x7f00000002c0)=0x14) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000004c0), 0x0) ioctl$VHOST_GET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af14, &(0x7f0000000180)) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x4000, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x0, 0x2) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000a80)) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000280)) listen(r1, 0x4) r3 = getpgrp(0x0) fcntl$lock(r0, 0x7, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0x2, r3}) r4 = dup2(r1, r1) socket$netlink(0x10, 0x3, 0x4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000600)=0x74) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000000)='/dev/amidi#\x00', 0xffffffffffffffff}, 0x30) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000680)={0x0, 0x9, 0x5171, 0x1, 0xffffffffffffffff, 0x8, 0x2, 0x1, {0x0, @in={{0x2, 0x4e20}}, 0x5, 0x7, 0xff, 0x9565, 0x9}}, &(0x7f0000000740)=0xb0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000780)=ANY=[], &(0x7f00000007c0)) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000002b40)={0x0, 0x58, &(0x7f0000002ac0)=[@in6={0xa, 0x4e20, 0x9, @empty, 0x5}, @in6={0xa, 0x4e23, 0x6a, @remote, 0xdd8f}, @in={0x2, 0x4e22, @rand_addr=0x6}, @in={0x2, 0x4e24, @multicast2}]}, &(0x7f0000002b80)=0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000002bc0)={0x0, 0x6}, &(0x7f0000002c00)=0x8) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000003440)={0x0, 0x7, 0x9, 0x4}, &(0x7f0000003480)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f00000034c0)={0x0, @in={{0x2, 0x4e21, @multicast2}}, 0x8f3, 0x7}, &(0x7f0000003580)=0x90) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000380)=ANY=[@ANYRES32=r6, @ANYBLOB="2b000000fd8e8e983fe721ccacf083247767f2b5071b59f9b99f0ff5121b57b65226bd49a65032998931585e82000100000000"], &(0x7f0000003a40)=0x33) sendmmsg$inet_sctp(r4, &(0x7f0000003b00)=[{&(0x7f0000003680)=@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10, &(0x7f00000039c0)=[{&(0x7f0000003940)="f2d6ec35a9d5f1321ea5720cb9ae9ac9d75d4f7896486379d6431e3119ed432012707f113cd9b0275fb8384e2a16b54f1f3dd711b4775d4332970d61ea82ee0339a2bd92929bf6ebfe", 0x49}], 0x1, &(0x7f0000003a80), 0x0, 0x81}], 0x1, 0x400c840) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, &(0x7f00000001c0)) pipe2(&(0x7f0000000140), 0x800) sendto$inet6(r5, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = accept4(r1, 0x0, &(0x7f00000003c0), 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000300)=ANY=[@ANYRES32=0x0], &(0x7f0000000340)=0x1) dup3(r0, r7, 0x80000) 01:47:29 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x200004c1}, 0x5000000) 01:47:29 executing program 3 (fault-call:0 fault-nth:1): syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 348.891679] binder: 12951:12952 ioctl c0306202 200002c0 returned -22 [ 348.899924] binder_alloc: binder_alloc_mmap_handler: 12951 20001000-20004000 already mapped failed -16 [ 348.909741] binder: BINDER_SET_CONTEXT_MGR already set [ 348.915203] binder: 12951:12952 ioctl 40046207 0 returned -16 [ 348.921867] binder_alloc: 12951: binder_alloc_buf, no vma [ 348.927630] binder: 12951:12953 transaction failed 29189/-3, size 0-0 line 3035 01:47:29 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r2, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x6000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0xa8, r3, 0x20, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x1}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x1f}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x8}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x10}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x20}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0xaea5}]}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xa8}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000340)={{0xf004, 0x0, 0xf, 0x1, 0x66, 0x0, 0x2, 0x5, 0x10000, 0xf95, 0x5, 0x3d58}, {0xd000, 0x1, 0x3, 0x8, 0x100000000, 0x0, 0xc07, 0x5, 0xb5, 0xfffffffffffff9ab, 0x0, 0x8000}, {0x111006, 0x5000, 0xe, 0x2, 0x9, 0x97a, 0x1f, 0x2, 0x2, 0xee, 0xc00c, 0x4}, {0x0, 0x1000, 0xf, 0x200, 0xffff, 0x8000, 0x3, 0x9d8, 0x6, 0x7, 0xfffffffffffffbff, 0xcf83}, {0x0, 0x2, 0x1f, 0x1f, 0x8, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0x1, 0x2c8}, {0x0, 0xf000, 0xf, 0x0, 0x100000000, 0xd43, 0x40, 0x3, 0x81, 0x9, 0x8, 0x6}, {0xf000, 0x100001, 0xa, 0x0, 0x8, 0x46b40000, 0x1, 0x0, 0xfffffffffffffffd, 0x21ca, 0x8, 0x35d4}, {0x1, 0x6000, 0x8, 0x8, 0x80000001, 0xfffffffffffffff7, 0xfff, 0xcc, 0xba, 0x9, 0xffffffff, 0x2}, {0x2000, 0x4000}, {0x1f000, 0x3001}, 0x40000000, 0x0, 0xf001, 0x8, 0x5, 0x400, 0xf004, [0xfff, 0x94cf, 0x7ff, 0x8]}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000000c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 01:47:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306209, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 349.044711] FAULT_INJECTION: forcing a failure. [ 349.044711] name failslab, interval 1, probability 0, space 0, times 0 [ 349.061196] binder: BINDER_SET_CONTEXT_MGR already set [ 349.074796] binder: 12966:12968 ioctl 40046207 0 returned -16 01:47:29 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x7ffff000}, 0x5000000) [ 349.104835] binder_alloc: 12951: binder_alloc_buf, no vma [ 349.134647] binder: 12966:12968 transaction failed 29189/-3, size 0-0 line 3035 [ 349.168777] binder: 12966:12975 ioctl c0306209 200002c0 returned -22 [ 349.174907] CPU: 1 PID: 12965 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #15 [ 349.182509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 349.191876] Call Trace: [ 349.191902] dump_stack+0x1db/0x2d0 [ 349.191924] ? dump_stack_print_info.cold+0x20/0x20 [ 349.191944] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 349.191960] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 349.191981] ? check_preemption_disabled+0x48/0x290 [ 349.192000] should_fail.cold+0xa/0x15 [ 349.223126] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 349.223149] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 349.223167] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.223194] ? __alloc_pages_nodemask+0xaca/0xdc0 [ 349.233944] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.238750] ? __might_fault+0x12b/0x1e0 [ 349.238775] __should_failslab+0x121/0x190 [ 349.238794] should_failslab+0x9/0x14 [ 349.238809] kmem_cache_alloc+0x47/0x710 [ 349.238828] ? ___might_sleep+0x1e7/0x310 [ 349.238854] __build_skb+0xaf/0x430 [ 349.243874] binder: send failed reply for transaction 175 to 12951:12952 [ 349.249141] ? skb_try_coalesce+0x1aa0/0x1aa0 [ 349.249160] ? kasan_check_write+0x14/0x20 [ 349.249176] ? copyin+0xb5/0x100 [ 349.249196] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 349.249215] build_skb+0x74/0x280 [ 349.249232] ? __build_skb+0x430/0x430 [ 349.249260] tun_build_skb.isra.0+0xf19/0x1770 [ 349.249284] ? tun_chr_read_iter+0x1e0/0x1e0 [ 349.313321] ? __lock_acquire+0x572/0x4a30 [ 349.317566] ? print_usage_bug+0xd0/0xd0 [ 349.321631] ? print_usage_bug+0xd0/0xd0 [ 349.325691] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.330634] ? mark_held_locks+0x100/0x100 [ 349.334871] ? aa_file_perm+0x42e/0x1090 [ 349.338935] ? find_held_lock+0x35/0x120 [ 349.343012] ? aa_file_perm+0x42e/0x1090 [ 349.347081] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 349.353649] tun_get_user+0xbc9/0x4150 [ 349.357556] ? kasan_check_read+0x11/0x20 [ 349.361709] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 349.366989] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.371947] ? tun_build_skb.isra.0+0x1770/0x1770 [ 349.376800] ? lock_downgrade+0x910/0x910 [ 349.380949] ? kasan_check_read+0x11/0x20 [ 349.385100] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 349.390384] ? rcu_read_unlock_special+0x380/0x380 [ 349.395329] ? tun_get+0x22e/0x380 [ 349.398871] ? tun_chr_close+0x180/0x180 [ 349.402933] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 349.407868] ? common_file_perm+0x231/0x800 [ 349.412202] tun_chr_write_iter+0xbd/0x160 [ 349.416442] do_iter_readv_writev+0x902/0xbc0 [ 349.420951] ? vfs_dedupe_file_range+0x780/0x780 [ 349.425710] ? apparmor_file_permission+0x25/0x30 [ 349.430566] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 349.436113] ? rw_verify_area+0x118/0x360 [ 349.440267] do_iter_write+0x184/0x610 [ 349.444161] ? dup_iter+0x260/0x260 [ 349.447790] ? lock_downgrade+0x910/0x910 [ 349.451952] vfs_writev+0x1ee/0x370 [ 349.455595] ? vfs_iter_write+0xb0/0xb0 [ 349.459584] ? kasan_check_write+0x14/0x20 [ 349.463830] ? __mutex_unlock_slowpath+0x195/0x870 [ 349.468765] ? wait_for_completion+0x810/0x810 [ 349.473358] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 349.478897] ? __fdget_pos+0xdc/0x1f0 [ 349.482701] ? __fdget_raw+0x20/0x20 [ 349.486420] ? __sb_end_write+0xd9/0x110 [ 349.490495] do_writev+0x11a/0x300 [ 349.494043] ? vfs_writev+0x370/0x370 [ 349.497853] ? trace_hardirqs_off_caller+0x300/0x300 [ 349.502965] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 349.507742] __x64_sys_writev+0x75/0xb0 [ 349.511728] do_syscall_64+0x1a3/0x800 [ 349.515627] ? syscall_return_slowpath+0x5f0/0x5f0 [ 349.520589] ? prepare_exit_to_usermode+0x232/0x3b0 [ 349.526226] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 349.531089] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 349.536289] RIP: 0033:0x457d81 [ 349.539489] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 b8 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 349.558401] RSP: 002b:00007f0c4765eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 349.566130] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 0000000000457d81 [ 349.573402] RDX: 0000000000000001 RSI: 00007f0c4765ebf0 RDI: 00000000000000f0 [ 349.580688] RBP: 0000000020000140 R08: 00000000000000f0 R09: 0000000000000000 [ 349.587961] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f0c4765f6d4 [ 349.595236] R13: 00000000004c636f R14: 00000000004db3f8 R15: 0000000000000003 [ 349.606398] binder_alloc: binder_alloc_mmap_handler: 12966 20001000-20004000 already mapped failed -16 01:47:29 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x1000000}, 0x5000000) 01:47:29 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x802, 0x0) ioctl$VIDIOC_G_CTRL(r0, 0xc008561b, &(0x7f0000000040)={0x7fff, 0x6c77}) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x44}}, 0x10) [ 349.634069] binder_alloc: 12966: binder_alloc_buf, no vma [ 349.648940] binder: 12966:12975 transaction failed 29189/-3, size 0-0 line 3035 01:47:29 executing program 3 (fault-call:0 fault-nth:2): syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 349.736281] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.768246] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.775452] FAULT_INJECTION: forcing a failure. [ 349.775452] name failslab, interval 1, probability 0, space 0, times 0 [ 349.787052] CPU: 1 PID: 12992 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #15 [ 349.791895] binder: undelivered TRANSACTION_COMPLETE [ 349.794250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 349.794260] Call Trace: [ 349.794285] dump_stack+0x1db/0x2d0 [ 349.794305] ? dump_stack_print_info.cold+0x20/0x20 [ 349.808763] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 349.808784] should_fail.cold+0xa/0x15 [ 349.808800] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.808817] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 349.808931] ? __nf_conntrack_find_get+0x1753/0x1cd0 [ 349.808953] ? __nf_conntrack_find_get+0x1753/0x1cd0 [ 349.815160] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 349.824882] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.825780] __should_failslab+0x121/0x190 [ 349.834014] binder: undelivered TRANSACTION_COMPLETE [ 349.834588] should_failslab+0x9/0x14 [ 349.834606] kmem_cache_alloc+0x47/0x710 [ 349.834625] ? rcu_read_unlock_special+0x380/0x380 [ 349.853138] binder: undelivered TRANSACTION_ERROR: 29189 [ 349.855432] __nf_conntrack_alloc+0x198/0x7a0 [ 349.855451] ? early_drop+0xc00/0xc00 [ 349.896760] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 349.902309] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 349.907510] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 349.913076] init_conntrack.isra.0+0xf8f/0x1380 [ 349.917758] ? nf_conntrack_alloc+0x50/0x50 [ 349.922091] ? __nf_conntrack_confirm+0x3510/0x3510 [ 349.927115] ? __sanitizer_cov_trace_switch+0x49/0x80 01:47:30 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000), 0x0, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc030620a, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:30 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) mmap(&(0x7f0000010000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/user\x00') ioctl$VT_RELDISP(r1, 0xb701) creat(&(0x7f0000001140)='./file0\x00', 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x1b, &(0x7f0000e95fe0)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x20) r3 = syz_open_procfs(0x0, &(0x7f0000787ff3)='net/anycast6\x00') preadv(r3, &(0x7f0000000100)=[{&(0x7f00002f0f89)=""/204, 0xcc}], 0x1, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f00000001c0)="56df4cc2a3788ce661de34fb0c63d571", 0x26a) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000040)=0x5) socket$xdp(0x2c, 0x3, 0x0) 01:47:30 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0xffffff7f}, 0x5000000) [ 349.932321] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 349.937968] ? ip6t_do_table+0xdc9/0x1d90 [ 349.942179] nf_conntrack_in+0xb95/0x1250 [ 349.946361] ? nf_conntrack_update+0xbb0/0xbb0 [ 349.950956] ? ip6t_error+0x40/0x40 [ 349.954600] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.959542] ? __sanitizer_cov_trace_cmp2+0x10/0x20 [ 349.959575] ipv6_conntrack_in+0x1e/0x30 [ 349.959590] nf_hook_slow+0xbf/0x1f0 [ 349.959700] ipv6_rcv+0x3b9/0x650 [ 349.959720] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 349.968833] ? pvclock_read_flags+0x160/0x160 [ 349.968855] ? ip6_rcv_finish_core.isra.0+0x720/0x720 [ 349.968880] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 349.968909] __netif_receive_skb_one_core+0x160/0x210 [ 349.968929] ? __netif_receive_skb_core+0x3750/0x3750 [ 349.968945] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 349.968961] ? rcu_softirq_qs+0x20/0x20 [ 349.990551] __netif_receive_skb+0x2c/0x1c0 [ 349.990571] netif_receive_skb_internal+0x11e/0x690 [ 349.990587] ? dev_cpu_dead+0xb60/0xb60 [ 349.990603] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 349.990618] ? rcu_pm_notify+0xd0/0xd0 [ 349.990645] netif_receive_skb+0xef/0x7e0 [ 349.990660] ? netif_receive_skb_internal+0x690/0x690 [ 349.990677] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.990697] ? tun_chr_read_iter+0x1e0/0x1e0 [ 349.990717] ? tun_rx_batched.isra.0+0x570/0xb30 [ 349.990734] tun_rx_batched.isra.0+0x614/0xb30 [ 349.990747] ? tun_get_user+0x2bc1/0x4150 [ 349.990828] ? __local_bh_enable_ip+0x15a/0x270 [ 349.990845] ? __local_bh_enable_ip+0x15a/0x270 [ 349.990863] ? tun_sock_write_space+0x390/0x390 01:47:30 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x100000000000000}, 0x5000000) [ 349.990877] ? trace_hardirqs_on+0xbd/0x310 [ 349.990893] ? tun_get_user+0x2bfe/0x4150 [ 349.990909] ? trace_hardirqs_off_caller+0x300/0x300 [ 349.990926] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 349.990944] ? check_preemption_disabled+0x48/0x290 [ 349.990963] ? tun_get_user+0x2bc1/0x4150 [ 349.990983] tun_get_user+0x2c2c/0x4150 [ 349.990998] ? kasan_check_read+0x11/0x20 [ 349.991014] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 349.991028] ? add_lock_to_list.isra.0+0x450/0x450 [ 349.991073] ? tun_build_skb.isra.0+0x1770/0x1770 [ 350.019713] ? lock_downgrade+0x910/0x910 [ 350.019734] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 350.019753] ? rcu_read_unlock_special+0x380/0x380 [ 350.019778] ? tun_get+0x22e/0x380 [ 350.070230] ? tun_chr_close+0x180/0x180 [ 350.070251] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 350.070272] ? common_file_perm+0x231/0x800 [ 350.103331] tun_chr_write_iter+0xbd/0x160 [ 350.103354] do_iter_readv_writev+0x902/0xbc0 [ 350.103376] ? vfs_dedupe_file_range+0x780/0x780 [ 350.103397] ? apparmor_file_permission+0x25/0x30 [ 350.157587] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 350.157610] ? rw_verify_area+0x118/0x360 [ 350.157630] do_iter_write+0x184/0x610 [ 350.157648] ? dup_iter+0x260/0x260 [ 350.157666] ? lock_downgrade+0x910/0x910 [ 350.198722] vfs_writev+0x1ee/0x370 [ 350.198744] ? vfs_iter_write+0xb0/0xb0 [ 350.198764] ? kasan_check_write+0x14/0x20 [ 350.198781] ? __mutex_unlock_slowpath+0x195/0x870 [ 350.198801] ? wait_for_completion+0x810/0x810 [ 350.198823] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 350.198838] ? __fdget_pos+0xdc/0x1f0 [ 350.198854] ? __fdget_raw+0x20/0x20 [ 350.240917] ? __sb_end_write+0xd9/0x110 [ 350.244998] do_writev+0x11a/0x300 [ 350.248566] ? vfs_writev+0x370/0x370 [ 350.252383] ? trace_hardirqs_off_caller+0x300/0x300 [ 350.257500] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 350.262278] __x64_sys_writev+0x75/0xb0 [ 350.266267] do_syscall_64+0x1a3/0x800 [ 350.270165] ? syscall_return_slowpath+0x5f0/0x5f0 [ 350.275108] ? prepare_exit_to_usermode+0x232/0x3b0 [ 350.280138] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 350.285000] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 350.290282] RIP: 0033:0x457d81 [ 350.293488] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 b8 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 350.312392] RSP: 002b:00007f0c4765eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 350.320106] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 0000000000457d81 [ 350.327380] RDX: 0000000000000001 RSI: 00007f0c4765ebf0 RDI: 00000000000000f0 01:47:30 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000), 0x0, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 350.334652] RBP: 0000000020000140 R08: 00000000000000f0 R09: 0000000000000000 [ 350.341922] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f0c4765f6d4 [ 350.349187] R13: 00000000004c636f R14: 00000000004db3f8 R15: 0000000000000003 [ 350.370658] binder: 13003:13012 transaction failed 29189/-22, size 0-0 line 2896 [ 350.380252] binder: undelivered TRANSACTION_ERROR: 29189 01:47:30 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0xffffff7f00000000}, 0x5000000) 01:47:30 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x80011, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) 01:47:30 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) r1 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x1, 0x2) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000200)={0x733, 0xc738, 0xfffffffffffffbff}, 0xc) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f00000000c0)={0x0, 0x0, [], @raw_data=[0x101, 0xfffffffffffff5f1, 0x7fff, 0x200, 0x9, 0x4, 0x4, 0xffff, 0x401, 0x1f, 0x7, 0x1, 0x401, 0x500000, 0x2682, 0x1ff, 0xc45, 0x2bba, 0xffff, 0x4, 0x7, 0x2, 0xa5fa, 0xfffffffffffffb1a, 0x4, 0x200, 0x4, 0x0, 0x0, 0x2, 0x708, 0x7fff]}) readv(r0, &(0x7f0000000240)=[{&(0x7f00000013c0)=""/135, 0x87}], 0x1) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000580)=""/223) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 01:47:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306225, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:30 executing program 3 (fault-call:0 fault-nth:3): syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 350.524527] binder: 13020:13021 ioctl c0306225 200002c0 returned -22 01:47:30 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000), 0x0, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 350.578227] binder_alloc: binder_alloc_mmap_handler: 13020 20001000-20004000 already mapped failed -16 01:47:30 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x1000000}, 0x5000000) [ 350.638084] binder: BINDER_SET_CONTEXT_MGR already set [ 350.650197] FAULT_INJECTION: forcing a failure. [ 350.650197] name failslab, interval 1, probability 0, space 0, times 0 [ 350.661453] CPU: 1 PID: 13033 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #15 [ 350.668640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 350.668648] Call Trace: [ 350.668672] dump_stack+0x1db/0x2d0 [ 350.668696] ? dump_stack_print_info.cold+0x20/0x20 [ 350.668721] ? nf_conntrack_in+0xb95/0x1250 [ 350.693577] ? ipv6_conntrack_in+0x1e/0x30 [ 350.697815] ? nf_hook_slow+0xbf/0x1f0 [ 350.701707] ? ipv6_rcv+0x3b9/0x650 [ 350.705339] ? __netif_receive_skb_one_core+0x160/0x210 [ 350.710708] ? netif_receive_skb_internal+0x11e/0x690 [ 350.715907] should_fail.cold+0xa/0x15 [ 350.719796] ? do_syscall_64+0x1a3/0x800 [ 350.723859] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 350.728961] ? should_fail+0x1e6/0xd22 [ 350.732848] ? add_lock_to_list.isra.0+0x450/0x450 [ 350.737781] ? add_lock_to_list.isra.0+0x450/0x450 [ 350.742716] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 350.748254] ? find_held_lock+0x35/0x120 [ 350.752319] ? nf_ct_ext_add+0x31f/0x7b0 [ 350.756385] __should_failslab+0x121/0x190 [ 350.760628] should_failslab+0x9/0x14 [ 350.764429] __kmalloc_track_caller+0x6d/0x740 [ 350.769014] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 350.774294] ? rcu_read_unlock_special+0x380/0x380 [ 350.779226] ? nf_ct_ext_add+0x368/0x7b0 [ 350.783292] __krealloc+0x71/0xc0 [ 350.786753] nf_ct_ext_add+0x368/0x7b0 [ 350.790644] ? nf_ct_ext_destroy+0x380/0x380 [ 350.795064] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 350.800608] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 350.805796] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 350.811345] init_conntrack.isra.0+0x44e/0x1380 [ 350.816019] ? nf_conntrack_alloc+0x50/0x50 [ 350.820349] ? __nf_conntrack_confirm+0x3510/0x3510 [ 350.825364] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 350.830565] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 350.836107] ? ip6t_do_table+0xdc9/0x1d90 [ 350.840265] nf_conntrack_in+0xb95/0x1250 [ 350.844433] ? nf_conntrack_update+0xbb0/0xbb0 [ 350.849019] ? ip6t_error+0x40/0x40 [ 350.852655] ? add_lock_to_list.isra.0+0x450/0x450 [ 350.857582] ? __sanitizer_cov_trace_cmp2+0x10/0x20 [ 350.862612] ipv6_conntrack_in+0x1e/0x30 [ 350.866676] nf_hook_slow+0xbf/0x1f0 [ 350.870396] ipv6_rcv+0x3b9/0x650 [ 350.873854] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 350.878612] ? pvclock_read_flags+0x160/0x160 [ 350.883113] ? ip6_rcv_finish_core.isra.0+0x720/0x720 [ 350.888314] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 350.893076] __netif_receive_skb_one_core+0x160/0x210 [ 350.898272] ? __netif_receive_skb_core+0x3750/0x3750 [ 350.903461] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 350.908739] ? rcu_softirq_qs+0x20/0x20 [ 350.912719] __netif_receive_skb+0x2c/0x1c0 [ 350.917044] netif_receive_skb_internal+0x11e/0x690 [ 350.922074] ? dev_cpu_dead+0xb60/0xb60 [ 350.926053] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 350.931590] ? rcu_pm_notify+0xd0/0xd0 [ 350.935493] netif_receive_skb+0xef/0x7e0 [ 350.939645] ? netif_receive_skb_internal+0x690/0x690 [ 350.944840] ? add_lock_to_list.isra.0+0x450/0x450 [ 350.949778] ? tun_chr_read_iter+0x1e0/0x1e0 [ 350.954195] ? tun_rx_batched.isra.0+0x570/0xb30 [ 350.958957] tun_rx_batched.isra.0+0x614/0xb30 [ 350.963548] ? tun_get_user+0x2bc1/0x4150 [ 350.967697] ? __local_bh_enable_ip+0x15a/0x270 [ 350.972370] ? __local_bh_enable_ip+0x15a/0x270 [ 350.977039] ? tun_sock_write_space+0x390/0x390 [ 350.981711] ? trace_hardirqs_on+0xbd/0x310 [ 350.986040] ? tun_get_user+0x2bfe/0x4150 [ 350.990218] ? trace_hardirqs_off_caller+0x300/0x300 [ 350.995326] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 351.001065] ? check_preemption_disabled+0x48/0x290 [ 351.006093] ? tun_get_user+0x2bc1/0x4150 [ 351.010245] tun_get_user+0x2c2c/0x4150 [ 351.014219] ? kasan_check_read+0x11/0x20 [ 351.018371] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 351.023656] ? add_lock_to_list.isra.0+0x450/0x450 [ 351.028605] ? tun_build_skb.isra.0+0x1770/0x1770 [ 351.033455] ? lock_downgrade+0x910/0x910 [ 351.037605] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 351.042883] ? rcu_read_unlock_special+0x380/0x380 [ 351.047822] ? tun_get+0x22e/0x380 [ 351.051385] ? tun_chr_close+0x180/0x180 [ 351.055453] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 351.060387] ? common_file_perm+0x231/0x800 [ 351.064711] tun_chr_write_iter+0xbd/0x160 [ 351.068948] do_iter_readv_writev+0x902/0xbc0 [ 351.073447] ? vfs_dedupe_file_range+0x780/0x780 [ 351.078417] ? apparmor_file_permission+0x25/0x30 [ 351.083265] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 351.088805] ? rw_verify_area+0x118/0x360 [ 351.092958] do_iter_write+0x184/0x610 [ 351.096846] ? dup_iter+0x260/0x260 [ 351.100474] ? lock_downgrade+0x910/0x910 [ 351.104625] vfs_writev+0x1ee/0x370 [ 351.108254] ? vfs_iter_write+0xb0/0xb0 [ 351.112232] ? kasan_check_write+0x14/0x20 [ 351.116469] ? __mutex_unlock_slowpath+0x195/0x870 [ 351.121406] ? wait_for_completion+0x810/0x810 [ 351.126013] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 351.132066] ? __fdget_pos+0xdc/0x1f0 [ 351.135877] ? __fdget_raw+0x20/0x20 [ 351.139597] ? __sb_end_write+0xd9/0x110 [ 351.143670] do_writev+0x11a/0x300 [ 351.147216] ? vfs_writev+0x370/0x370 [ 351.151023] ? trace_hardirqs_off_caller+0x300/0x300 [ 351.156132] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 351.160896] __x64_sys_writev+0x75/0xb0 [ 351.164874] do_syscall_64+0x1a3/0x800 [ 351.168765] ? syscall_return_slowpath+0x5f0/0x5f0 [ 351.173696] ? prepare_exit_to_usermode+0x232/0x3b0 [ 351.178717] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 351.183578] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 351.188774] RIP: 0033:0x457d81 [ 351.192016] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 b8 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 351.210926] RSP: 002b:00007f0c4765eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 351.218632] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 0000000000457d81 [ 351.225900] RDX: 0000000000000001 RSI: 00007f0c4765ebf0 RDI: 00000000000000f0 [ 351.233165] RBP: 0000000020000140 R08: 00000000000000f0 R09: 0000000000000000 [ 351.240429] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f0c4765f6d4 [ 351.247692] R13: 00000000004c636f R14: 00000000004db3f8 R15: 0000000000000003 [ 351.308376] binder: 13020:13021 ioctl 40046207 0 returned -16 [ 351.314947] binder_alloc: 13020: binder_alloc_buf, no vma 01:47:31 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0xffffff7f}, 0x5000000) [ 351.359117] binder: 13020:13042 transaction failed 29189/-3, size 0-0 line 3035 [ 351.372362] binder: undelivered TRANSACTION_ERROR: 29189 [ 351.395588] binder: send failed reply for transaction 183 to 13020:13021 01:47:31 executing program 4: r0 = accept(0xffffffffffffffff, &(0x7f0000000700)=@sco, &(0x7f00000000c0)=0x80) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000680)=0x8, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x4c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x281, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x0, 0x300) recvmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000002580)}}], 0x1, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="2c44682e97000000ca87559dc4f9765d90cd0c88b111c42692cb49521c3aa61d0044cc690e954e3a4a57b51ba8b259def5161bd431c89110ff2c1eadb2c4c0384a7729ef4a601b939f27a4a496fb94a15ddc9032a678adbe1fe187664899f4408f43e79fe424b54bac5b645a6135fd4aace0979dfea70d41290c9c"], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000480)=[@dead_binder_done], 0x1, 0xfdfdffff, &(0x7f0000000600)=';'}) [ 351.407953] binder: undelivered TRANSACTION_COMPLETE 01:47:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c", 0x25, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 351.436919] binder: undelivered TRANSACTION_ERROR: 29189 01:47:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306254, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:31 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x100000000000000}, 0x5000000) [ 351.514423] binder: 13049:13050 unknown command 778585132 [ 351.558135] binder: 13049:13050 ioctl c0306201 20012000 returned -22 [ 351.599637] binder: 13049:13055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 351.610572] binder: 13056:13059 ioctl c0306254 200002c0 returned -22 01:47:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c", 0x25, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 351.641974] binder: 13050 RLIMIT_NICE not set [ 351.666689] binder_alloc: binder_alloc_mmap_handler: 13056 20001000-20004000 already mapped failed -16 [ 351.685281] binder: 13049:13055 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 351.703458] binder: 13049:13055 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 351.709662] binder: BINDER_SET_CONTEXT_MGR already set [ 351.716124] binder: 13056:13062 ioctl 40046207 0 returned -16 [ 351.740725] binder_alloc: 13056: binder_alloc_buf, no vma [ 351.786924] binder: 13056:13065 transaction failed 29189/-3, size 0-0 line 3035 [ 351.844718] binder: send failed reply for transaction 186 to 13056:13059 [ 351.862247] binder: undelivered TRANSACTION_ERROR: 29189 [ 351.867734] binder: undelivered TRANSACTION_COMPLETE 01:47:32 executing program 5: r0 = socket$inet6(0xa, 0xa, 0x8000) ioctl(r0, 0x0, &(0x7f0000000200)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcs\x00', 0x8200000, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000780)=0x3dc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) r3 = syz_open_dev$sndpcmp(&(0x7f00000005c0)='/dev/snd/pcmC#D#p\x00', 0x40, 0x4) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0xffff, 0x80) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) r4 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00006dbffc), 0x4) ioctl$int_in(r4, 0x15421, &(0x7f0000000900)=0x8) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000080), 0x4) sendto$inet(r4, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000500)={r5, 0x1, 0x6, @local}, 0x10) r6 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedsend(r6, &(0x7f0000000040), 0x0, 0x0, 0x0) ioctl$void(r1, 0xc0045878) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f00000002c0)={0xd2b, 0x5, 0xa1a, 0x6}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000200)=""/122) mq_timedsend(r6, &(0x7f0000000580), 0x0, 0x0, 0x0) mq_timedreceive(r6, &(0x7f0000000340)=""/24, 0x18, 0x0, 0x0) getcwd(&(0x7f0000000180)=""/118, 0x76) unshare(0x40000000) sendto$inet(r4, &(0x7f00004b3fff), 0x0, 0x0, 0x0, 0x0) 01:47:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0xffffff7f00000000}, 0x5000000) 01:47:32 executing program 3 (fault-call:0 fault-nth:4): syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:32 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c", 0x25, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306263, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 352.023055] binder: 13076:13077 ioctl c0306263 200002c0 returned -22 [ 352.067895] binder_alloc: binder_alloc_mmap_handler: 13076 20001000-20004000 already mapped failed -16 01:47:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x1000000}, 0x5000000) 01:47:32 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d096", 0x37, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 352.113308] binder: BINDER_SET_CONTEXT_MGR already set [ 352.130704] binder: 13076:13077 ioctl 40046207 0 returned -16 [ 352.214747] binder_alloc: 13076: binder_alloc_buf, no vma [ 352.245771] binder: 13076:13090 transaction failed 29189/-3, size 0-0 line 3035 [ 352.277008] binder: 13049:13092 unknown command 778585132 [ 352.281940] binder: 13076:13077 ioctl c0306263 200002c0 returned -22 [ 352.293225] binder: 13049:13093 unknown command 536872576 [ 352.324431] binder: release 13076:13077 transaction 189 out, still active [ 352.346911] binder: undelivered TRANSACTION_COMPLETE [ 352.350960] binder: 13095 RLIMIT_NICE not set [ 352.352299] binder: 13049:13099 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 352.385678] binder: 13049:13092 ioctl c0306201 20012000 returned -22 [ 352.398795] binder: send failed reply for transaction 189, target dead [ 352.410779] binder: 13049:13093 ioctl c0306201 20008fd0 returned -22 01:47:32 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif-pclmul\x00'}, 0x58) r1 = dup3(r0, r0, 0x80000) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000340)=0x21, 0x2) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={r0}) fgetxattr(r2, &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000280)=""/137, 0x89) connect$rxrpc(r2, &(0x7f0000000080)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @multicast1}}, 0x24) r3 = accept4(r0, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/fib_trie\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="b400003e000100001d000000020000009500eeff00000020a89e95"], &(0x7f0000000080)='GPL\x04\x9c5\x14\xbfw-\xa0z\xe8.vY\n6\xf6I>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcR\xd0\x13\x17]\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde]!\xa5\xea\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P)\xbb*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#f\xf3=\x95\xdb\xa9/\x86ry\xca\xbfJ\xce\xdd\xc8Z\x8a\xf7\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'}, 0x48) sendfile(r3, r4, 0x0, 0xef9) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0x1) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0)=0x100, 0x4) ioctl$EVIOCSKEYCODE(r4, 0x40084504, &(0x7f0000000140)=[0xfffffffffffffffb, 0x2]) setsockopt$CAIFSO_LINK_SELECT(r0, 0x116, 0x7f, &(0x7f0000000000)=0x2, 0x4) 01:47:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x5000000) 01:47:32 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d096", 0x37, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306276, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 352.579696] binder: 13109:13110 ioctl c0306276 200002c0 returned -22 [ 352.596403] IPVS: ftp: loaded support on port[0] = 21 01:47:32 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x5000000) [ 352.663711] binder_alloc: binder_alloc_mmap_handler: 13109 20001000-20004000 already mapped failed -16 [ 352.709332] binder: BINDER_SET_CONTEXT_MGR already set [ 352.766841] binder: 13109:13110 ioctl 40046207 0 returned -16 [ 352.769309] FAULT_INJECTION: forcing a failure. [ 352.769309] name failslab, interval 1, probability 0, space 0, times 0 [ 352.783999] CPU: 0 PID: 13080 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #15 [ 352.784012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 352.784020] Call Trace: [ 352.784041] dump_stack+0x1db/0x2d0 [ 352.784064] ? dump_stack_print_info.cold+0x20/0x20 [ 352.784082] ? rcu_read_unlock_special+0x380/0x380 [ 352.784107] should_fail.cold+0xa/0x15 [ 352.784126] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 352.784149] ? find_held_lock+0x35/0x120 [ 352.829995] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 352.835585] __should_failslab+0x121/0x190 [ 352.839835] should_failslab+0x9/0x14 [ 352.839852] kmem_cache_alloc+0x47/0x710 [ 352.839964] sctp_chunkify+0xc4/0x410 [ 352.839981] ? sctp_chunk_iif+0xa0/0xa0 [ 352.855631] ? bpf_skb_vlan_push+0x760/0x760 [ 352.855660] ? kasan_check_write+0x14/0x20 [ 352.864590] sctp_rcv+0xd39/0x4010 [ 352.868138] ? trace_hardirqs_off_caller+0x300/0x300 [ 352.873260] ? sctp_addrs_lookup_transport+0xaa0/0xaa0 [ 352.873284] ? mark_held_locks+0x100/0x100 [ 352.873302] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 352.873321] ? ip6t_do_table+0xd4d/0x1d90 [ 352.873371] ? raw6_local_deliver+0x6e4/0xc70 [ 352.873410] ? ip_vs_in+0x26a/0x2960 [ 352.892573] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 352.892600] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 352.892615] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 352.892637] ? check_preemption_disabled+0x48/0x290 [ 352.892678] ? __lock_is_held+0xb6/0x140 [ 352.900935] sctp6_rcv+0x17/0x30 [ 352.917473] ip6_protocol_deliver_rcu+0x3aa/0x1940 [ 352.917507] ? ipv6_list_rcv+0x760/0x760 [ 352.917527] ? rcu_read_unlock_special+0x380/0x380 [ 352.917575] ip6_input_finish+0x84/0x170 [ 352.935084] ip6_input+0xf9/0x600 [ 352.935105] ? ip6_input_finish+0x170/0x170 [ 352.935129] ? ip6_protocol_deliver_rcu+0x1940/0x1940 [ 352.935144] ? lock_downgrade+0x910/0x910 [ 352.935163] ? kasan_check_read+0x11/0x20 [ 352.944135] ? rcu_read_unlock_special+0x380/0x380 [ 352.944158] ip6_rcv_finish+0x177/0x330 [ 352.944178] ipv6_rcv+0x113/0x650 [ 352.944198] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 352.944216] ? pvclock_read_flags+0x160/0x160 [ 352.951734] ? ip6_rcv_finish_core.isra.0+0x720/0x720 [ 352.951802] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 352.961294] __netif_receive_skb_one_core+0x160/0x210 [ 352.961314] ? __netif_receive_skb_core+0x3750/0x3750 [ 352.961346] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 352.961367] ? rcu_softirq_qs+0x20/0x20 [ 352.961392] __netif_receive_skb+0x2c/0x1c0 [ 352.969700] netif_receive_skb_internal+0x11e/0x690 [ 352.969717] ? dev_cpu_dead+0xb60/0xb60 [ 352.969734] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 352.969750] ? rcu_pm_notify+0xd0/0xd0 [ 352.969781] netif_receive_skb+0xef/0x7e0 [ 352.978690] ? netif_receive_skb_internal+0x690/0x690 [ 352.978725] ? add_lock_to_list.isra.0+0x450/0x450 [ 352.978756] ? tun_chr_read_iter+0x1e0/0x1e0 [ 352.978805] ? tun_rx_batched.isra.0+0x570/0xb30 [ 352.986984] tun_rx_batched.isra.0+0x614/0xb30 [ 352.986999] ? tun_get_user+0x2bc1/0x4150 [ 352.987017] ? __local_bh_enable_ip+0x15a/0x270 [ 352.987033] ? __local_bh_enable_ip+0x15a/0x270 [ 352.987052] ? tun_sock_write_space+0x390/0x390 [ 352.987066] ? trace_hardirqs_on+0xbd/0x310 [ 352.987083] ? tun_get_user+0x2bfe/0x4150 [ 353.006941] ? trace_hardirqs_off_caller+0x300/0x300 [ 353.006960] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 353.006984] ? check_preemption_disabled+0x48/0x290 [ 353.007002] ? tun_get_user+0x2bc1/0x4150 [ 353.017484] tun_get_user+0x2c2c/0x4150 [ 353.017503] ? kasan_check_read+0x11/0x20 [ 353.017520] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 353.017561] ? add_lock_to_list.isra.0+0x450/0x450 [ 353.025854] ? tun_build_skb.isra.0+0x1770/0x1770 [ 353.025880] ? lock_downgrade+0x910/0x910 [ 353.025898] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 353.025915] ? rcu_read_unlock_special+0x380/0x380 [ 353.034918] ? tun_get+0x22e/0x380 [ 353.034941] ? tun_chr_close+0x180/0x180 [ 353.034959] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 353.044370] ? common_file_perm+0x231/0x800 [ 353.044392] tun_chr_write_iter+0xbd/0x160 [ 353.044414] do_iter_readv_writev+0x902/0xbc0 [ 353.044436] ? vfs_dedupe_file_range+0x780/0x780 [ 353.044454] ? apparmor_file_permission+0x25/0x30 [ 353.053774] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 353.053794] ? rw_verify_area+0x118/0x360 [ 353.053814] do_iter_write+0x184/0x610 [ 353.053831] ? dup_iter+0x260/0x260 [ 353.053852] ? lock_downgrade+0x910/0x910 [ 353.069122] IPVS: ftp: loaded support on port[0] = 21 [ 353.072499] vfs_writev+0x1ee/0x370 [ 353.072521] ? vfs_iter_write+0xb0/0xb0 [ 353.072555] ? kasan_check_write+0x14/0x20 [ 353.072574] ? __mutex_unlock_slowpath+0x195/0x870 [ 353.081710] ? wait_for_completion+0x810/0x810 [ 353.081735] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 353.081752] ? __fdget_pos+0xdc/0x1f0 [ 353.091104] ? __fdget_raw+0x20/0x20 [ 353.091137] ? __sb_end_write+0xd9/0x110 [ 353.091177] do_writev+0x11a/0x300 [ 353.099618] ? vfs_writev+0x370/0x370 [ 353.099638] ? trace_hardirqs_off_caller+0x300/0x300 [ 353.099657] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 353.099678] __x64_sys_writev+0x75/0xb0 [ 353.099695] do_syscall_64+0x1a3/0x800 [ 353.110328] ? syscall_return_slowpath+0x5f0/0x5f0 [ 353.110347] ? prepare_exit_to_usermode+0x232/0x3b0 [ 353.110369] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 353.110396] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 353.110408] RIP: 0033:0x457d81 [ 353.110425] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 b8 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 353.110434] RSP: 002b:00007f0c4765eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 353.119582] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 0000000000457d81 [ 353.119598] RDX: 0000000000000001 RSI: 00007f0c4765ebf0 RDI: 00000000000000f0 [ 353.119623] RBP: 0000000020000140 R08: 00000000000000f0 R09: 0000000000000000 [ 353.119632] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f0c4765f6d4 [ 353.119645] R13: 00000000004c636f R14: 00000000004db3f8 R15: 0000000000000003 [ 353.184770] binder: send failed reply for transaction 192 to 13109:13110 [ 353.242117] binder: undelivered TRANSACTION_COMPLETE 01:47:36 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d096", 0x37, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:36 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0xffffffb2, 0x1b8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0x0, 0x0, 0x0, 0x0, 0xbd2, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xffffffffffff2b3d, 0x200080) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0xe) 01:47:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x54, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:36 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x5000000) 01:47:36 executing program 5: r0 = socket$inet6(0xa, 0xa, 0x8000) ioctl(r0, 0x0, &(0x7f0000000200)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcs\x00', 0x8200000, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000780)=0x3dc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) r3 = syz_open_dev$sndpcmp(&(0x7f00000005c0)='/dev/snd/pcmC#D#p\x00', 0x40, 0x4) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0xffff, 0x80) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) r4 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00006dbffc), 0x4) ioctl$int_in(r4, 0x15421, &(0x7f0000000900)=0x8) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000080), 0x4) sendto$inet(r4, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000500)={r5, 0x1, 0x6, @local}, 0x10) r6 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedsend(r6, &(0x7f0000000040), 0x0, 0x0, 0x0) ioctl$void(r1, 0xc0045878) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f00000002c0)={0xd2b, 0x5, 0xa1a, 0x6}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000200)=""/122) mq_timedsend(r6, &(0x7f0000000580), 0x0, 0x0, 0x0) mq_timedreceive(r6, &(0x7f0000000340)=""/24, 0x18, 0x0, 0x0) getcwd(&(0x7f0000000180)=""/118, 0x76) unshare(0x40000000) sendto$inet(r4, &(0x7f00004b3fff), 0x0, 0x0, 0x0, 0x0) 01:47:36 executing program 3 (fault-call:0 fault-nth:5): syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 356.518783] binder: 13128:13129 got new transaction with bad transaction stack, transaction 194 has target 13128:0 [ 356.540705] FAULT_INJECTION: forcing a failure. [ 356.540705] name failslab, interval 1, probability 0, space 0, times 0 [ 356.552214] CPU: 1 PID: 13135 Comm: syz-executor3 Not tainted 5.0.0-rc1+ #15 [ 356.559413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 356.568764] Call Trace: [ 356.571360] dump_stack+0x1db/0x2d0 [ 356.574998] ? dump_stack_print_info.cold+0x20/0x20 [ 356.580034] should_fail.cold+0xa/0x15 [ 356.582510] binder: 13128:13129 transaction failed 29201/-71, size 0-0 line 2946 [ 356.583939] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 356.583978] ? print_usage_bug+0xd0/0xd0 [ 356.596641] __should_failslab+0x121/0x190 [ 356.596663] should_failslab+0x9/0x14 [ 356.608724] kmem_cache_alloc_node+0x56/0x710 [ 356.613238] __alloc_skb+0xf4/0x730 [ 356.616887] ? skb_scrub_packet+0x440/0x440 [ 356.621289] ? xfrm_policy_lookup_inexact_addr+0x193/0x6b0 [ 356.621307] ? xfrm_policy_lookup_inexact_addr+0x193/0x6b0 [ 356.628135] binder_alloc: binder_alloc_mmap_handler: 13128 20001000-20004000 already mapped failed -16 [ 356.632550] ? lockdep_hardirqs_on+0x19b/0x5d0 [ 356.632568] ? trace_hardirqs_on+0xbd/0x310 [ 356.632590] _sctp_make_chunk+0x5e/0x280 [ 356.632609] sctp_make_abort+0x15d/0x200 [ 356.632624] sctp_make_abort_violation+0x90/0x240 [ 356.632641] ? sctp_make_abort_user+0x120/0x120 [ 356.632655] ? find_held_lock+0x35/0x120 [ 356.632708] ? is_bpf_text_address+0xac/0x170 [ 356.632755] sctp_sf_abort_violation.isra.0+0x152/0xd50 [ 356.651062] sctp_sf_ootb+0x4c4/0x6a0 [ 356.651082] ? rcu_softirq_qs+0x20/0x20 [ 356.690303] sctp_do_sm+0x197/0x7020 [ 356.694026] ? kernel_text_address+0x73/0xf0 [ 356.694147] binder: BINDER_SET_CONTEXT_MGR already set [ 356.698463] ? sctp_do_8_2_transport_strike.isra.0+0x940/0x940 [ 356.698491] ? __lock_acquire+0x572/0x4a30 [ 356.709722] ? sctp_chunkify+0xc4/0x410 01:47:36 executing program 4: socketpair$unix(0x1, 0x4, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fe) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x3, 0x0) ioctl$NBD_SET_BLKSIZE(r1, 0xab01, 0x2) r2 = socket$inet(0x10, 0x4004000000000003, 0x0) sendmsg(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000002c0)="24000000240007031dfffd946fa2830020200a000500000000030000000000000000ff7e280000001100ffffba16a0aa1cd109b3ebea0800b1cc7e63975c0ac47b6268e3966cf055d90f15a350e4f364cb66e8cc382ce2be66961e2ff4980974a2f8798208ded08e363fa382763fa7149740c5599b8c88d95b47000000000000008c39cf778ace310865cd95f0e3e6efe0c4d48527e31240857a8bc3aaccf8a9c4706cdac624a6d742ce14d001baab39def966ea2b4b8b30dbe640aa4691e64906af8b715133ba4a3c62b9ee0d09b35b216f9da58bf79330ceeecf01f770c2e23e8d821e8429fbcd36efcca98e85658fe45d1d074076bb23d016d02240288d4ce02833398ea77cb3125429d15ca1fdb5d08900fa50908615e25a084dccdcde47c59e38", 0x373}], 0x10000000000000ad, 0x0, 0x21a}, 0x1) 01:47:36 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee", 0x40, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 356.717908] ? sctp_rcv+0xd39/0x4010 [ 356.721623] ? sctp6_rcv+0x17/0x30 [ 356.725173] ? ip6_protocol_deliver_rcu+0x3aa/0x1940 [ 356.730285] ? ip6_input_finish+0x84/0x170 [ 356.734527] ? ip6_input+0xf9/0x600 [ 356.738166] ? ip6_rcv_finish+0x177/0x330 [ 356.742322] ? ipv6_rcv+0x113/0x650 [ 356.745954] ? __netif_receive_skb_one_core+0x160/0x210 [ 356.751323] ? __netif_receive_skb+0x2c/0x1c0 [ 356.755821] ? netif_receive_skb_internal+0x11e/0x690 [ 356.761018] ? netif_receive_skb+0xef/0x7e0 [ 356.765093] binder: 13128:13129 ioctl 40046207 0 returned -16 [ 356.765354] ? mark_held_locks+0x100/0x100 [ 356.775455] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 356.780477] ? skb_pull+0xd4/0x110 [ 356.784031] ? sctp_inq_pop+0x478/0x10a0 [ 356.784063] ? sctp_inq_peek+0xd0/0xd0 [ 356.784085] ? __lock_is_held+0xb6/0x140 [ 356.784106] sctp_endpoint_bh_rcv+0x471/0x9b0 [ 356.792045] ? sctp_endpoint_lookup_assoc+0x290/0x290 [ 356.792067] ? add_lock_to_list.isra.0+0x450/0x450 [ 356.792082] ? sctp_rcv+0xea4/0x4010 [ 356.792106] sctp_inq_push+0x288/0x3a0 [ 356.792125] ? sctp_inq_free+0x3b0/0x3b0 [ 356.792141] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 356.792159] ? check_preemption_disabled+0x48/0x290 [ 356.792180] sctp_rcv+0x2cef/0x4010 [ 356.792197] ? trace_hardirqs_off_caller+0x300/0x300 [ 356.792229] ? sctp_addrs_lookup_transport+0xaa0/0xaa0 [ 356.792250] ? mark_held_locks+0x100/0x100 [ 356.792266] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 356.792284] ? ip6t_do_table+0xd4d/0x1d90 [ 356.792303] ? raw6_local_deliver+0x6e4/0xc70 [ 356.792320] ? ip_vs_in+0x26a/0x2960 [ 356.845998] binder_alloc: 13128: binder_alloc_buf, no vma [ 356.847088] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 356.847109] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 356.847124] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 356.847142] ? check_preemption_disabled+0x48/0x290 [ 356.847169] ? __lock_is_held+0xb6/0x140 [ 356.878132] binder: 13128:13144 transaction failed 29189/-3, size 0-0 line 3035 [ 356.880316] sctp6_rcv+0x17/0x30 [ 356.880338] ip6_protocol_deliver_rcu+0x3aa/0x1940 [ 356.880371] ? ipv6_list_rcv+0x760/0x760 [ 356.880392] ? rcu_read_unlock_special+0x380/0x380 [ 356.880415] ip6_input_finish+0x84/0x170 [ 356.880433] ip6_input+0xf9/0x600 [ 356.880456] ? ip6_input_finish+0x170/0x170 [ 356.901338] binder: send failed reply for transaction 194 to 13128:13129 [ 356.908007] ? ip6_protocol_deliver_rcu+0x1940/0x1940 [ 356.908024] ? lock_downgrade+0x910/0x910 [ 356.908041] ? kasan_check_read+0x11/0x20 [ 356.908068] ? rcu_read_unlock_special+0x380/0x380 [ 356.908088] ip6_rcv_finish+0x177/0x330 [ 356.916368] ipv6_rcv+0x113/0x650 [ 356.916390] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 356.916408] ? pvclock_read_flags+0x160/0x160 [ 356.916428] ? ip6_rcv_finish_core.isra.0+0x720/0x720 [ 356.916453] ? ip6_rcv_core.isra.0+0x1e10/0x1e10 [ 356.962417] __netif_receive_skb_one_core+0x160/0x210 [ 356.962437] ? __netif_receive_skb_core+0x3750/0x3750 [ 356.962455] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 356.962473] ? rcu_softirq_qs+0x20/0x20 [ 356.962495] __netif_receive_skb+0x2c/0x1c0 [ 356.962515] netif_receive_skb_internal+0x11e/0x690 [ 356.962531] ? dev_cpu_dead+0xb60/0xb60 [ 356.962556] ? rcu_lockdep_current_cpu_online+0x1aa/0x220 [ 356.962572] ? rcu_pm_notify+0xd0/0xd0 [ 356.962600] netif_receive_skb+0xef/0x7e0 [ 356.962616] ? netif_receive_skb_internal+0x690/0x690 [ 357.041273] ? add_lock_to_list.isra.0+0x450/0x450 [ 357.046211] ? tun_chr_read_iter+0x1e0/0x1e0 [ 357.050627] ? tun_rx_batched.isra.0+0x570/0xb30 [ 357.055389] tun_rx_batched.isra.0+0x614/0xb30 [ 357.059975] ? tun_get_user+0x2bc1/0x4150 [ 357.064125] ? __local_bh_enable_ip+0x15a/0x270 [ 357.068793] ? __local_bh_enable_ip+0x15a/0x270 [ 357.073463] ? tun_sock_write_space+0x390/0x390 [ 357.078132] ? trace_hardirqs_on+0xbd/0x310 [ 357.082457] ? tun_get_user+0x2bfe/0x4150 [ 357.086609] ? trace_hardirqs_off_caller+0x300/0x300 [ 357.091714] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 357.097252] ? check_preemption_disabled+0x48/0x290 [ 357.102272] ? tun_get_user+0x2bc1/0x4150 [ 357.106428] tun_get_user+0x2c2c/0x4150 [ 357.110404] ? kasan_check_read+0x11/0x20 [ 357.114559] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 357.119837] ? add_lock_to_list.isra.0+0x450/0x450 [ 357.124788] ? tun_build_skb.isra.0+0x1770/0x1770 [ 357.129643] ? lock_downgrade+0x910/0x910 [ 357.134304] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 357.139587] ? rcu_read_unlock_special+0x380/0x380 [ 357.144528] ? tun_get+0x22e/0x380 [ 357.148078] ? tun_chr_close+0x180/0x180 [ 357.152143] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 357.157078] ? common_file_perm+0x231/0x800 [ 357.161405] tun_chr_write_iter+0xbd/0x160 [ 357.165648] do_iter_readv_writev+0x902/0xbc0 [ 357.170150] ? vfs_dedupe_file_range+0x780/0x780 [ 357.174906] ? apparmor_file_permission+0x25/0x30 [ 357.179751] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 357.185289] ? rw_verify_area+0x118/0x360 [ 357.189441] do_iter_write+0x184/0x610 [ 357.193331] ? dup_iter+0x260/0x260 [ 357.196961] ? lock_downgrade+0x910/0x910 [ 357.201119] vfs_writev+0x1ee/0x370 [ 357.204752] ? vfs_iter_write+0xb0/0xb0 [ 357.208731] ? kasan_check_write+0x14/0x20 [ 357.212966] ? __mutex_unlock_slowpath+0x195/0x870 [ 357.217899] ? wait_for_completion+0x810/0x810 [ 357.222489] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 357.228025] ? __fdget_pos+0xdc/0x1f0 [ 357.231830] ? __fdget_raw+0x20/0x20 [ 357.235557] ? __sb_end_write+0xd9/0x110 [ 357.239627] do_writev+0x11a/0x300 [ 357.243170] ? vfs_writev+0x370/0x370 [ 357.246972] ? trace_hardirqs_off_caller+0x300/0x300 [ 357.252082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 357.256845] __x64_sys_writev+0x75/0xb0 [ 357.260825] do_syscall_64+0x1a3/0x800 [ 357.264717] ? syscall_return_slowpath+0x5f0/0x5f0 [ 357.269678] ? prepare_exit_to_usermode+0x232/0x3b0 [ 357.274704] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 357.279564] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 357.284752] RIP: 0033:0x457d81 [ 357.287944] Code: 75 14 b8 14 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 b8 fb ff c3 48 83 ec 08 e8 1a 2d 00 00 48 89 04 24 b8 14 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 63 2d 00 00 48 89 d0 48 83 c4 08 48 3d 01 [ 357.306844] RSP: 002b:00007f0c4765eba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 [ 357.314562] RAX: ffffffffffffffda RBX: 0000000000000055 RCX: 0000000000457d81 01:47:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x76, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 357.321834] RDX: 0000000000000001 RSI: 00007f0c4765ebf0 RDI: 00000000000000f0 [ 357.329103] RBP: 0000000020000140 R08: 00000000000000f0 R09: 0000000000000000 [ 357.336371] R10: 0000000000000064 R11: 0000000000000293 R12: 00007f0c4765f6d4 [ 357.343641] R13: 00000000004c636f R14: 00000000004db3f8 R15: 0000000000000003 01:47:37 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x0}, 0x5000000) 01:47:37 executing program 4: r0 = accept$inet(0xffffffffffffff9c, &(0x7f0000000140)={0x2, 0x0, @empty}, &(0x7f0000000180)=0x10) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f00000001c0)={'filter\x00'}, &(0x7f0000000240)=0x44) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_XSAVE(r4, 0xc080aebe, &(0x7f0000000680)) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x30000, 0x0) ioctl$EVIOCGID(r5, 0x80084502, &(0x7f00000000c0)=""/125) [ 357.437568] binder: 13153:13154 got new transaction with bad transaction stack, transaction 198 has target 13153:0 [ 357.459850] binder: 13153:13154 transaction failed 29201/-71, size 0-0 line 2946 [ 357.502327] binder_alloc: binder_alloc_mmap_handler: 13153 20001000-20004000 already mapped failed -16 [ 357.544402] binder: BINDER_SET_CONTEXT_MGR already set [ 357.561754] binder: 13153:13154 ioctl 40046207 0 returned -16 [ 357.576506] binder_alloc: 13153: binder_alloc_buf, no vma [ 357.583737] binder: 13153:13157 transaction failed 29189/-3, size 0-0 line 3035 01:47:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x2, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:37 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 357.625620] IPVS: ftp: loaded support on port[0] = 21 01:47:37 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x0}, 0x5000000) [ 357.742687] binder: BINDER_SET_CONTEXT_MGR already set 01:47:38 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x0}, 0x5000000) [ 357.800378] binder: 13171:13174 ioctl 40046207 0 returned -16 01:47:38 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x0}, 0x5000000) [ 357.843437] binder: 13171:13183 unknown command 16448 [ 357.844702] binder_alloc: 13153: binder_alloc_buf, no vma [ 357.852604] binder: 13171:13183 ioctl c0306201 200002c0 returned -22 [ 357.867030] binder_release_work: 3 callbacks suppressed [ 357.867037] binder: undelivered TRANSACTION_ERROR: 29189 [ 357.867099] binder: 13171:13177 transaction failed 29189/-3, size 0-0 line 3035 [ 357.876953] binder: send failed reply for transaction 198 to 13153:13154 [ 357.927666] binder_alloc: binder_alloc_mmap_handler: 13171 20001000-20004000 already mapped failed -16 [ 357.949626] binder: undelivered TRANSACTION_COMPLETE [ 357.969500] binder: undelivered TRANSACTION_ERROR: 29201 [ 357.975386] binder: undelivered TRANSACTION_ERROR: 29189 [ 357.995518] binder_alloc: 13171: binder_alloc_buf, no vma [ 358.005122] binder: undelivered TRANSACTION_ERROR: 29189 [ 358.025639] binder: undelivered TRANSACTION_COMPLETE [ 358.042328] binder: 13171:13177 transaction failed 29189/-3, size 0-0 line 3035 [ 358.051206] binder: undelivered TRANSACTION_ERROR: 29201 [ 358.069205] binder: undelivered TRANSACTION_ERROR: 29189 [ 358.089732] binder: undelivered TRANSACTION_ERROR: 29189 [ 358.140967] binder: undelivered TRANSACTION_ERROR: 29189 01:47:38 executing program 5: r0 = socket$inet6(0xa, 0xa, 0x8000) ioctl(r0, 0x0, &(0x7f0000000200)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcs\x00', 0x8200000, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000780)=0x3dc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) r3 = syz_open_dev$sndpcmp(&(0x7f00000005c0)='/dev/snd/pcmC#D#p\x00', 0x40, 0x4) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0xffff, 0x80) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) r4 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00006dbffc), 0x4) ioctl$int_in(r4, 0x15421, &(0x7f0000000900)=0x8) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000080), 0x4) sendto$inet(r4, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000500)={r5, 0x1, 0x6, @local}, 0x10) r6 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedsend(r6, &(0x7f0000000040), 0x0, 0x0, 0x0) ioctl$void(r1, 0xc0045878) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f00000002c0)={0xd2b, 0x5, 0xa1a, 0x6}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000200)=""/122) mq_timedsend(r6, &(0x7f0000000580), 0x0, 0x0, 0x0) mq_timedreceive(r6, &(0x7f0000000340)=""/24, 0x18, 0x0, 0x0) getcwd(&(0x7f0000000180)=""/118, 0x76) unshare(0x40000000) sendto$inet(r4, &(0x7f00004b3fff), 0x0, 0x0, 0x0, 0x0) 01:47:38 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000040)={@multicast2, @broadcast, 0x0}, &(0x7f0000000080)=0xc) sendmsg(r0, &(0x7f0000001b40)={&(0x7f0000000100)=@ll={0x11, 0x1c, r1, 0x1, 0x7}, 0x80, &(0x7f00000002c0)=[{&(0x7f00000001c0)="33464c91817f80456062813a58d07bc3b98a8ee45abaabdbe6d4f0e517d32a102a4b69e020e12aa7d578f9d43a6808aed3abebdb3b425e55b3786c13d92d00e910bd07167d27933c09ce39e9ed83dc5cde53899f6386eade1ad32bd65ca3ab52eb1aa5aa256a0fd3608e92506e4b4dd01c4647644997ddcecb8dbdaf5ad84a873b196f6102cdde24beab71bd04285040dca70f317286fc89f57b01b10760d389e4e1f39c003ba95b5a58c14af2d8bfc86159f6c5209005590314a37abf203824052329934993ddde12f07b9e4b10def9c68d0906fc0bf6d900a85677a67ce5b514af121b76bf40d600f773302b783fbdc59e1df2f7040c53aef2", 0xfa}, {&(0x7f00000003c0)="c7dc214fb16afbe2abea2b3000c8c81a48758c460b0bc3c1eae45eda5de11e694293ef51debf58c95280d6190d07a8a6ab7d286e1d980eced4ac78d19bccd8a1fa21e758da0d9e7892e49002398221f0d3326ea673fbb190a32354b82e70d6d86bd9b1498bf11f412b9ac5bd9bbd7b8b5ee5904055f0d1b0b65da588bc06c0f88c4c30ef08175add2babcd57e4fac45d6b6da1c6498228249b71820d40fea2b119ff373be2fdb9125d256edbfea1f1fbc93ba9ed8482ee36737de4488118b9587d254df712871fdd3cef5d000cdf124edbd55fec6cf8db5b37f455eed0a779e04e1bcc33e8", 0xe5}, {&(0x7f00000004c0)="6b4b3384eebcdca9f29a8946e4cd9b7dcf055fd027c0f3af6bd3013da8e5a70295532de01c248d752148d81422ba4a1f3a1e595193c6fa2ad965f2467b76095bb57fb763c3454463ffee083791c1026136a4914c38530884d1dc07249d28ec71e544842cfe04220513794aa9d78fdcb6492b2688cc41769a88ce66b4f2047c3011e984b63a69c8a7542f923cd86f4bd9ed078099ae80d54fb66f10dba93610b2db5d331e81904128003a1fdcdae4529d3c815e46c4f7d3f15d547d5ece5f", 0xbe}, {&(0x7f0000000580)="d87a514729eb268e76de8ac5816040fc3c3f4207d5fe95a61b26c3932fa8594646de72dbd18704a64d42943f77d0b7bb0abbebbdbb39ea986310795bcdfaa9395bb3005f8eaba2308ef773431a2870bbf541af869fc43d7c7b7f6b3a80ced6262a5fb89272b2cc6f34355b336e063708ef56418396e3adad464dfc3eb504ddfc18314acd32110b08d32c8050827314528f805fb93becc049b502b84aac37c1a10da489c0687e80c38ea2a542901ff07d39f276af27e9eae1", 0xb8}, {&(0x7f0000000640)="13d37287a1745b2751945bbf0f151572c0b5c6671570c3e19858d30b3b448071fb31389e5ac3218ea1562781ccdede2d73b804e45e532fceea5a323c4ae893fae9795de581cc8398c9e5e8a724cbfaf15a80f0a3740c90a9c11d0256ff3fc0697be4c38cdac2fadaff83605d7a375c7cb464df5eb7ecce9a799bc91350d73c4aab9a55fc6288629fe58219a4573a2a5afb84f2951abc69f3fe023fc5a268c9da71fd2c86962ad03f51779b8e78256903ee29b741540b73e1d14bca30f1bc2c47e2524c422765ef622195e4bf830c32baf419113bd2510701f146126026d50714373a40df6085136e1c96e4df5ad3fce785e52a07c601ddcc4ab318ea", 0xfc}, {&(0x7f0000000740)="4a8ae993b544ab190f9b3d9c0b32ba49eab65df2aca6fac6efed4bbe3525025b91e9c9117be6ccd38727dcbcd3fa437b1132fd936f42eb1059e1a9dbf85dd3037b565f29ea29e27f2dd20d5f45b595916b89c630a611a8554fda3f7f71768b80edf6d7b0018cf8c3ca128ac55685927c98d8c7beb1935b5ca95bd5d216cc8a1205b3c417babcea0a502bbbc4ca4e70b3172ffe37917dc1cf2797b97477f9d498f8bafbd5ab6d950db01ce928ce3b80f28f5cd23d29c3d56cd8144f0c42aa9fe9fd339682fe87337d4eb3594f717d34516bbfb30a074de250ad1e5a807d2294858e88efc34b978552678f9de943ee1e484a2e5fabfbd5a134990ee1d3615ada3e376753bc513226ba703efc80881e8921ffb890219ba49aed9da57feb4a5180b687a0ba3aeec5d7449421ff57c7085183ac135cde630a662c8cc2149c0588fcfbc6be6abe347de775d1c25f2a9f87ff79450c7650a7231c592f54bcf7417a7e91a43efc4ed11b6dcfa6e335ff8f868cfd40a3bc3ec57150da5b23e695009a050477ca11651875b4e9fd0083569ff5aab885beb7a9750debb8f4aa5ef80fb2e26a9d918ce3b85d015a980c80619843f3c6f278aa9e49b7fe3ecece1e40280dfce96e73205e17ebbdb06c5b74ac8779061b9d6112f439ea56cdf7e97c6da048ba7efc0614af6c90b082362f37ffd7b74cee81137b84dd080078516acf628babb8f8ba475ae64125a6e08511a96f4c87c4dd2c601f94115ca5078cbb092c71444ad1045204d3490094fd0e338a3e6f56843aaba1b2f60d40cdd936da335f7e9c0f65bae6543c3fe81ed54923a7f3f7d985e380ace97185365bb3bf85db4a7e65534a032f9f2b94523c2bf56df1c729fbc368480130a9f4cce25cbdf2a26a2492e11de60ab438249245d70138dfb98f44151737755d80a804860dcba7db7cb473f8260ee5e7a1d2588d188b020aa4aea4434df464c133f461b35034d88cf1d724c3e0bcc929ac2b417bc851589474c5bb8a94c13532d1f17248670c412e8b79128b0cce6278cdb024f4a6f9b2ae47bc10fcd1aefa3da62d2e5fd719f0a3aef8ac5045a87ce826f27216b1953b929d9e0b9e47558c8483a917927ef5d51dec19eb71c110c2e21d1b44daf3bae50b7aaaa695b690b75c0b202c51411b69b3076003dc13c39a64fe8d92933469d3c4774e9ce55a941a924f11e01db8e32af7094ed117bc4bd4683aa4abf0cbf1bc0563680886530293503ad02f3fdad074583b19a9b14b09033c1f6ecc10767dbc496a7375158d3043e917438abfd29a15d5e5428c3fdcd6a13392fd8f7957cf2bd17b04b4ec3e3284358fc5eeb2bc6d48f94b1f2c36e78bf0b2924e6130593469d71b77632104847807ef1e7b1bd7eb37ee940fcbbf015fd39b4a46a55c46678f97ce8023ca11ca860beeda9cdde95158abbdf99e7b9a623addf6042e89f7e499513cf1eb7242bd531b31def1b1e580b47bbbab9af50dbb75ea9c6f66c7ffda6a81a46520070f2323b71c077112d2dd3752acc2642492bca567c89bd1ae887153688abeadf25d263e1f42068e0be49e39354f2206959fa1ee00d375b7c1a3c98d9a439012af431c6b687a9749b27d87fae977a7b3d98aa506669a3b652c4e0d5ab2c7929ee45decbbf94a5f3ba54751b11cc70782dbcf74848028ff625f09f54108cdbec770c088bf13b9c8594338dcab754fe057fef06dd1b0cae10119a7295e102346e2957ee9bc99a65f31bdee4cd7d4fbad5981080e38b12c8163531d0fcbf07ed824e2f776bc53444fccb327ed430b4b41794ad9f6b228de4668b568eb5bfc59623cec6ffe246dd257b77fbdcf708a2960b4cc2e0ce7ff477359b9023d14284076352fb743ee46db0fb7cdd34008f5fbb6f12cd5719bf06840fc180b858b7e0ebcbf36d38dfa4b94f7fba9c778140160370ef39bda0e6412b51c40a01f31d6d35bc14eea2b2672a9ea0836b678e679b42e01d4c006ff8884be723d6d629274931d3d696a42011287c68da648b7c16213cb6fb1a8f751b987dcf3700e1a15286a64ecdd6fea06d492081d1a4333ec4b569ed584bc94f1fab764b92434f5e20edd5866ab0084be0c81f921dcea1b829a29cdf82e9e8126db087270a73bab96414770c2e7b14cf850f4b74135ed32e4b0330a1801b999aa4f51d4c8238352bebe0f002eb77c5e2c41edcdf92422b1e5a61b8598247760b0b7bc338810b327a68c028d82b950a714d61ec38f30a53a2ca9370c36378e8ade398d816bfd3562d8d7761f8102f75c7d8acb041de66963304977ad3859990d6af04fc280f28d61ca51f34baa51b0eef54043036701c0549aec826e50ce0a5f16c3e110b2071020fa8bdfd43510f7e3bd1c90f6d0441aa4b53e37f842d0260fa9caae587415189b1f4c20c1bdcdd7e61693c015e8d70e4850644b71f98c7f5deada4a4ac9c0e3d0ce2fdb694e19a127fd6b92011736ab2fde59b69032f15007ea5847e7266fe945ce492cc8b2551a5a7b703b4418b7f9ecc75d48ca4b925b36cc205056174a2b2f3bb16efa7bd98a79ad6318ab1701002ec70e9e67fe1e244e0ff623efe7a04e81c109edfe1b170e34fa5716edf0765c8bfba2395b0e8bc7895841578116ac40712bab815cef2ead4bde2388593493eb786e2419ef695bf8a9845bd133b986d2c56089abb499a757bd7b3c4806413ec2feecf4b2a818d85e98ee3cb39cbd693fd57ddb63b89d0711f8a6f1d299dd85481916f542d0010b8293d4255c8d0edcc9a622c4fbf62e155d205a3dc1a9023c8e2d9d7f832fb458a7e64b2849dc5689f63f1f24c00dc0e3b8a5d093c553808038ca4a825edd3d0e20a1af812a043e84993ea47176f4f99c33521a721fd48e6f27aaa7e2149b795a4c6c14024d2eb427d10e1532c235a7bb7c620a5f296d715a7e177a9150447f376e7b7465c8d1cf4cf6e33ca4670512ffa2e35b91f044cbd1bcd01bebd6e62cb999340f02ca86952c22f2cc4313fc43c0d7bfd94df899b703df25215eb59a5ea8c7589a30f7517db7e5a9367e2447a7e6b924eb7128ca58dc37b76c7b0f43d9110808753770d017f565698aef813561697f736e0c0042cd63a46c7eb5e79aef2b92f03133723e9713e820f08c14c3d2f867ff1d9f2a7a737840f9ef9a71334fc822c810aa00429c8f9e587e90cb2d8165469d268e2bb0dd16de912ca19210dbca43ce69b2a3775a91a03356295694ee34f2ddbd4077fa4959294e7cdb69b9c41facdd1cc8cb94eaa60a46f6c8a3d26951406300d4183505c26f217361a3bbc22619673d55a9f22d542b4c4756fb9f5e215e6be70666e0087b7bd43cf23599f663068d3ca27816b4b5178b1a48b3883b471414a44b46e23d8e18e950150d5f8f9ef6a4e029a40fe3e2321ad790593074e82274bbb2db0f537ee5adb8d5e52266cc35c91b0e60106ba65df9c1597a2a5be745025f8b2460477480610bc44a90c029f3d8b4c58d16ef0dd4cf170012d6c89d777013b98da7d1828b5744097c7d1fcaa2ec5beed2e301453da0839b4f0bdba7869e0558b142805e8e8a4c3038e406dffd34dada2be81a1dec5c6c905a2f18edc3eac03b4c81fda2abb62998f9579f70c8c6031acd86d712004c1278d298ce2140071ade72cdd078d3a8c67af8582a10378c8b49b06ebffc028e45336e649f7bcce9fa02a82973661f76cea63338ae7ec20eed110ba565a1b91f46b3e62f352ab520005b770686db5fbf6d2fe42de388b32817f27afb0a0f9c2e1b134bb51a0c0101030996156a61faadac28d5d868e26396d98484aa5b496122521fdaf82109af905a0b532ce2287679e4973fa6e4f41c55052a12b98d69674da51ec18e5098e9cc26ac5f451ace32f52dcc9a707f8ff511a00b0b0a5eb72cc2d569512364d8ef8d5e84b92abf39fda91b92de291ce4affbd57529c837e5c71879ce669a4d86526b41da1cf84bbe896a11532a4a5baaddf41d337ae394e5c39b433d5ccb500770e5652d9541fe170bf0e784ac2260f1ea50b11b200e5c6fd1513892a779bd71ae5e1bb6f98e859d8d2e2fd8444a2fe349359c9d7902ba139a759f243a226da05c804f640c54fe8ef036fbb06cab4fe107d1e9cbef62ac9022568810014d7e24ecb3fc302780bd79300f90bfce0edb33733e56acfcc46a95ad4203a7c733fac64e4b9d3f648c26d71e9d1487b8d15b2897eb33d22207e1f9b391c197207beef809c1a04c0d4f47a553b863b27e512d473cc9f6cabc42274de8098686fd0f59a104b1c47c1a5e894464e597ba8bb8ef99a10a9bbe9424d11d32be0396bc3a1162e60f86f9d6703cb847d2ddc45f26c3415e0731cff00c061f8ea06a242af3e7d21bf1aeaada4b661f3d08a5bfbb7b96f2f4cbd4381196863bb78e8b368f88c9e78fefa9625da06cebf91e827176ad59bba58838469f14ac72f9fabf8a075c37f2cd0a71e81f77a566cac30e997cda9336675f9a1ceae367ffda02afce493bcc8fe822af5b98c0da7f38e9d080692b5eb6b077fdad9fe67cc0077643ff246e89a81d6e40fed66f2b8a0b7ce836e075b1bcd53b5ca9e5c92ee0f66551fbb7eefc10489746abd9a8e341b920c0a5c40304a22021b31a47175ee4d46fcbaf68985d2e4840d38de026a421fa95315b5f66f2bd37dd35482775a8ea67b60572b3adc19f29fc15eeeb764c48961656433da02e2db7eb3998b363daa306ecf19e53afbeac0d84b390140bda3915bb6d0595a983dde4bcfcb9b5390393e11271f7e31f548580524f8e63d1cf84e5d3216a5fac6c79e26464d22a9586330373ece80bc433ab27e763553febd335dc0b4dead4620715e7eb3debcbb35d68020d016a65cce2031ccd8d2f5de9fa73efc1875bf0aa2db6e09a3dd069f52facd1717b78fa269c0c14cb2ef73c25840aef374e87495352d3deb90cba019183c5ffaba023594e160d3c24a069fde3581e16f216bea606d003e23162350d853906974131c1f34327f0551d51db9a05908ff4642f9abe44ccd16d9eedcf524bbc5264fd3cf98f592c4008d51d9ad54d4cc7887c3ebe430ed5588a5ccf38f6cc6f00d958ae77bf2b9838ef573846e8fb092d5c6a9f6ff080f6fb76044f6fd33b58c3439c426b14ee4a878fa83816183e7e677879cdfdafd2b9f6901b11e4b234ef0142e869dda4700e5388685e3a43674dce06e1384b0fce0592b258b65461450b61d6472f78ddbc3522069696173731d39a70a7cdbce6fcbed7cff0059ec6e424b2017af816e3ba91bca689fc9b70d5e029ca54e2f12653e242954d12ce0be9977d04aec156e481451fde4fa12b32a7f74e880e451dfeec847d6dd7408b4c65e23221c5c05ff97395b926928cfbf6e80572ef68c29aed52fad86853cbf1c217c598063763530848ece93fae9dc33f7dd5c8ce4c341d6e4116027c657e0263042d432cd977f5ac3f1f1ef0d107a8e1da0d282099fe727bc3cdb95aa2727f5e47dfdd9d271907084dae3f3b49913096775d525875f8a1d106ab8265c5f15f8cc029e51e7deb80ab7171e2f2a60afc5aff7c8518992ca67dd39ec53fc101119e1e0b54baf8808bfbcd7b131766e9ca5f3c7e201c444cc521609919de03504b513ac4b4ace29fb0dc3a823e291e7e697096680a8523e458c3503373210a5c2730f709e49db63deeb65aff0929f8a251b9de1f7489529896b8eb962c0a1b3b6cde8f10f95c8979aae9e0efa04afa079e7447d8d1f4a821b109262a75536462f6f02594d7e36ae1bcc1895e0fa4964a08164621b4cf55beada65b1bcba2", 0x1000}, {&(0x7f0000001740)="54c243d5736f708d6b844e53261dce7ce6bb22443642981efc7d4301505207142d1ae0a56a525bf1b6a3b423d7ab7e0d84eed7d342ccc1d74bd41f1bdd2818e37b52c9c150956e87fbfe47b358825fc7acd887b1615d3b2e8e80c9fc3fc1de01c8caff56ddc610ebd2160b8d1d7708ea0da74c67be5a67700bf2c9f11767d6bd05b700c1bd5faf61b36ce829c11719688acfa23d2e79df4e839530125a3a03", 0x9f}], 0x7, &(0x7f0000001800)=[{0xf0, 0x11f, 0x9, "7f45a08f7ec510c6d5024cbdbbedb262df4c0496c43ff5bbb9ca7552ee0e9dc2a033739eb22980a129465fa7a8b7be915099cd8299fad94cecbf056b9be3d0ff50ffd3cbd14e5e2bc65c080fa3ccf45cb66555f2aec4266391aba22eeb7af91a44769a474c11cbe3b98c6e79ef02bc2a67a91be1c9ee440af6a2929191366a93dd4efdfd338ccf0d2ced4843b07b1c76a39d40244a87dd0aa61fca2038bd5ec97beb5861501a980e84b2ddc81100c418d685c3cbda1cb48bd953e86ead9fb9cd4769bfdbd6f320f0dc398baf9fd065308ff66631ec85e98ed86270bd"}, {0x78, 0x29, 0x2, "0a5836b50180685eef4deeb376a628b3b5c1ba19f98ac0f57823b865375d311be5b0441f967e5c6797e27dde91e4be9ad280084661fd1a38cf04184caaab4015e55c39087eecd6ec07eca012ec84ad6366d56240da239a29e6e1dd0fba0a64eba37ffc"}, {0x40, 0x113, 0x40, "cad5b6eb1568b412620eadf5ecff071e3411224e78fb28648ec518851556b1552a57456d555c64754f69904db632051d"}, {0x18, 0x10d, 0x7, "8acef5d33f2291"}, {0xc8, 0x1, 0x1b, "c1acb38746ff5733c953c5253b0360aa321b401ba4268e077e121e62176426e2e7526c7eee1e52f623f74f65b2aff00cd45c97dabc7b5d734ccdef2e63c3a711ae9d7b5509bfc7b550b0ae44ddd60f2d538d12bffe255aeea53dfc7fb01247d04d7a237eb064171ef648880b89f1b8e59767ff283171c277550a689568f5b45986c89e8b0a0291db70b66defe32ae66bef09b06341d6a2bbe9693259bf15c903ba7b775450a1954f428f5eb9cb3b411ce04158"}, {0x68, 0x108, 0x9, "f95aeb8421fc07ae90e57cc118b572cd50c00fd539039de27407dd0743717a529c62db2548c94f0753d8e6979cbc0b1d0628219d500088b75d93e7d0ab3114479c8c07dacec99f1071f0353696f7f8529e971c"}, {0x48, 0x11f, 0x48ae28a4, "1ea520cd628c2c70094793ed8c0e64d38f8d8b0234356d32294999b688e19c1c43cd5ad159ca678b898a609411a0aa803a4bafefc1"}], 0x338}, 0x4) close(r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:38 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee", 0x40, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x3, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:38 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000100)={0xe18f, {{0x2, 0x4e22, @local}}}, 0x88) 01:47:38 executing program 3: syz_emit_ethernet(0xd, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 358.425774] binder: 13198:13199 unknown command 64 [ 358.460604] binder: 13198:13199 ioctl c0306201 200002c0 returned -22 01:47:38 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee", 0x40, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 358.521188] binder_alloc: binder_alloc_mmap_handler: 13198 20001000-20004000 already mapped failed -16 [ 358.591376] binder: BINDER_SET_CONTEXT_MGR already set [ 358.608479] binder: 13198:13199 ioctl 40046207 0 returned -16 [ 358.669525] binder_alloc: 13198: binder_alloc_buf, no vma [ 358.679921] binder: 13198:13218 transaction failed 29189/-3, size 0-0 line 3035 01:47:38 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000100)={0xe18f, {{0x2, 0x4e22, @local}}}, 0x88) [ 358.722095] binder: 13198:13199 unknown command 64 [ 358.727091] binder: 13198:13199 ioctl c0306201 200002c0 returned -22 [ 358.750764] binder: release 13198:13199 transaction 205 out, still active 01:47:39 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810", 0x45, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 358.778803] binder: undelivered TRANSACTION_COMPLETE [ 358.788933] binder: undelivered TRANSACTION_ERROR: 29189 [ 358.794462] binder: send failed reply for transaction 205, target dead [ 358.808687] IPVS: ftp: loaded support on port[0] = 21 [ 358.888043] binder: 13226:13227 unknown command 0 01:47:39 executing program 3: syz_emit_ethernet(0x95, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 358.946437] binder: 13226:13227 ioctl c0306201 200002c0 returned -22 [ 359.017094] binder_alloc: binder_alloc_mmap_handler: 13226 20001000-20004000 already mapped failed -16 01:47:39 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810", 0x45, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 359.062280] binder: BINDER_SET_CONTEXT_MGR already set [ 359.124347] binder: 13226:13227 ioctl 40046207 0 returned -16 [ 359.124364] binder: release 13226:13227 transaction 208 out, still active [ 359.140915] binder: undelivered TRANSACTION_COMPLETE [ 359.171606] binder: send failed reply for transaction 208, target dead 01:47:39 executing program 5: r0 = socket$inet6(0xa, 0xa, 0x8000) ioctl(r0, 0x0, &(0x7f0000000200)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcs\x00', 0x8200000, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000000c0), &(0x7f0000000780)=0x3dc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) r3 = syz_open_dev$sndpcmp(&(0x7f00000005c0)='/dev/snd/pcmC#D#p\x00', 0x40, 0x4) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x1}, {&(0x7f0000000680)=""/183, 0xb7}, &(0x7f0000000300), 0x3}, 0xa0) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0xffff, 0x80) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) r4 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00006dbffc), 0x4) ioctl$int_in(r4, 0x15421, &(0x7f0000000900)=0x8) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000080), 0x4) sendto$inet(r4, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast2}}, &(0x7f00000004c0)=0xe8) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000500)={r5, 0x1, 0x6, @local}, 0x10) r6 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedsend(r6, &(0x7f0000000040), 0x0, 0x0, 0x0) ioctl$void(r1, 0xc0045878) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f00000002c0)={0xd2b, 0x5, 0xa1a, 0x6}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000200)=""/122) mq_timedsend(r6, &(0x7f0000000580), 0x0, 0x0, 0x0) mq_timedreceive(r6, &(0x7f0000000340)=""/24, 0x18, 0x0, 0x0) getcwd(&(0x7f0000000180)=""/118, 0x76) unshare(0x40000000) sendto$inet(r4, &(0x7f00004b3fff), 0x0, 0x0, 0x0, 0x0) 01:47:39 executing program 3: syz_emit_ethernet(0xfdef, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:39 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810", 0x45, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x5, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:39 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x121000, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000080)={0xb, 0x2, 0x7ff, 0x4000}) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:39 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000100)={0xe18f, {{0x2, 0x4e22, @local}}}, 0x88) [ 359.527831] binder: 13245:13246 unknown command 0 [ 359.554987] binder: 13245:13246 ioctl c0306201 200002c0 returned -22 01:47:39 executing program 3: syz_emit_ethernet(0x20000195, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 359.612209] binder_alloc: binder_alloc_mmap_handler: 13245 20001000-20004000 already mapped failed -16 [ 359.665379] binder: BINDER_SET_CONTEXT_MGR already set 01:47:39 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000f56000)={0x1000000, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="020300020c00000000000000000000000200080008000000e000000000000000030006000000000002000000e0000001000000000000000002000100000000000000020000000000030005000000000002000000f00000010000000000000000"], 0x60}}, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 359.696205] binder: 13245:13246 ioctl 40046207 0 returned -16 01:47:39 executing program 3: syz_emit_ethernet(0x7ffff000, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 359.737203] binder_alloc: 13245: binder_alloc_buf, no vma 01:47:40 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5", 0x47, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 359.791047] binder: send failed reply for transaction 210 to 13245:13246 [ 359.808880] binder: 13245:13263 transaction failed 29189/-3, size 0-0 line 3035 [ 359.838892] binder: undelivered TRANSACTION_COMPLETE [ 359.866826] binder: undelivered TRANSACTION_ERROR: 29189 01:47:40 executing program 3: syz_emit_ethernet(0xfffffdef, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 359.981893] IPVS: ftp: loaded support on port[0] = 21 [ 360.087171] binder: 13278:13281 unknown command 0 [ 360.112425] binder: 13278:13281 ioctl c0306201 200002c0 returned -22 [ 360.160428] binder_alloc: binder_alloc_mmap_handler: 13278 20001000-20004000 already mapped failed -16 [ 360.205234] binder: BINDER_SET_CONTEXT_MGR already set [ 360.229636] binder: 13278:13281 ioctl 40046207 0 returned -16 [ 360.367832] binder_alloc: 13278: binder_alloc_buf, no vma [ 360.392703] binder: 13278:13287 transaction failed 29189/-3, size 0-0 line 3035 [ 360.432846] binder: 13278:13281 unknown command 0 [ 360.437936] binder: release 13278:13281 transaction 213 out, still active [ 360.449400] binder: 13278:13281 ioctl c0306201 200002c0 returned -22 [ 360.455970] binder: undelivered TRANSACTION_COMPLETE [ 360.485117] binder: send failed reply for transaction 213, target dead 01:47:40 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000f56000)={0x1000000, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="020300020c00000000000000000000000200080008000000e000000000000000030006000000000002000000e0000001000000000000000002000100000000000000020000000000030005000000000002000000f00000010000000000000000"], 0x60}}, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:40 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="742820e86590025c3e136d990d58bd6ad291480c037c7a60a32a09115bae49cd4f5332eef4a7533e72744eacdbb6057c1675ebdbd7c91605baa28111eec22215cfaa9c54d95b80e444b2c7d140e5852f4867598903ed12cd77b36e293b2771c0563404e70530585a64745bdc9018152d87b256a1676353ff9474c75c069eeba95a06ff94831bdd374baf849ae55d1043fb47c9254b755676f7b9d299c666ab083cf59eb18ac193a865edd0501e55f1456f44e926eb39a19af4ebd4d7c678720f67b45fc934fbf7637707c4331a93c19a400cea63e5d3"], 0x1}}, 0x5000000) 01:47:40 executing program 3: syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:40 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5", 0x47, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:40 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000100)={0xe18f, {{0x2, 0x4e22, @local}}}, 0x88) 01:47:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 360.732566] binder: 13290:13301 unknown command 0 [ 360.737998] binder: 13290:13301 ioctl c0306201 200002c0 returned -22 01:47:41 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000001a00)={@mcast2, 0x0}, &(0x7f0000001a40)=0x14) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001a80)={r3, @dev={0xac, 0x14, 0x14, 0x18}, @remote}, 0xc) sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r2, 0x40a, 0x70bd25, 0x35dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7bc5}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffffffffff7}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x40) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:41 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x2, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000040), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000001040)={0x90, 0xffffffff00000000, 0x2, {0x20000000007, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}}}, 0x90) r1 = syz_open_dev$vcsa(&(0x7f0000001340)='/dev/vcsa#\x00', 0x4, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000001140), &(0x7f0000001180)=0x14) futimesat(r1, 0x0, 0x0) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000001200)) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMRRU(r1, 0x4004743b, &(0x7f0000001240)=0x5) syz_genetlink_get_family_id$tipc(&(0x7f0000001100)='TIPC\x00') ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f00000011c0)={0x56, 0x9, 0xd0, 0x3, 0x5}) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000001280)=""/5) 01:47:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5", 0x47, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 360.852158] binder_alloc: binder_alloc_mmap_handler: 13290 20001000-20004000 already mapped failed -16 [ 360.942713] CUSE: unknown device info "" [ 360.952471] binder: BINDER_SET_CONTEXT_MGR already set [ 360.983881] binder: 13290:13301 ioctl 40046207 0 returned -16 [ 360.990594] CUSE: DEVNAME unspecified 01:47:41 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) 01:47:41 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x3, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 361.024430] binder_alloc: 13290: binder_alloc_buf, no vma [ 361.047488] binder: 13290:13319 transaction failed 29189/-3, size 0-0 line 3035 01:47:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5db", 0x48, 0x0, &(0x7f00000000c0)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x80) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 361.105172] binder: send failed reply for transaction 216 to 13290:13301 [ 361.140017] binder: undelivered TRANSACTION_COMPLETE 01:47:41 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) 01:47:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xa, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000040), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000001040)={0x90, 0xffffffff00000000, 0x2, {0x20000000007, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}}}, 0x90) r1 = syz_open_dev$vcsa(&(0x7f0000001340)='/dev/vcsa#\x00', 0x4, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000001140), &(0x7f0000001180)=0x14) futimesat(r1, 0x0, 0x0) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000001200)) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMRRU(r1, 0x4004743b, &(0x7f0000001240)=0x5) syz_genetlink_get_family_id$tipc(&(0x7f0000001100)='TIPC\x00') ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f00000011c0)={0x56, 0x9, 0xd0, 0x3, 0x5}) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000001280)=""/5) 01:47:41 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x2, 0x400) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000140)=r1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) close(r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) socket$key(0xf, 0x3, 0x2) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="7b9f4c1295c5c374261cf900434be042090806a00833e201a5f8fc664637f38970a2e0ae34613c9c7bb77f10a231ae08831d03e923e4512982f648b0d4117a75764d90e4844a8d41a2b9367d2a3fedb8269b3a14c324a344b51f97c24a942249d114809f071e000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x1000000000}, 0x5000000) 01:47:41 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x4, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 361.298884] CUSE: unknown device info "" [ 361.345480] CUSE: DEVNAME unspecified [ 361.355515] binder: 13336:13340 unknown command 0 [ 361.399181] binder: 13336:13340 ioctl c0306201 200002c0 returned -22 01:47:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 361.440407] binder_alloc: binder_alloc_mmap_handler: 13336 20001000-20004000 already mapped failed -16 01:47:41 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) 01:47:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000040), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000001040)={0x90, 0xffffffff00000000, 0x2, {0x20000000007, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}}}, 0x90) r1 = syz_open_dev$vcsa(&(0x7f0000001340)='/dev/vcsa#\x00', 0x4, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000001140), &(0x7f0000001180)=0x14) futimesat(r1, 0x0, 0x0) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000001200)) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) ioctl$PPPIOCSMRRU(r1, 0x4004743b, &(0x7f0000001240)=0x5) syz_genetlink_get_family_id$tipc(&(0x7f0000001100)='TIPC\x00') ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f00000011c0)={0x56, 0x9, 0xd0, 0x3, 0x5}) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000001280)=""/5) 01:47:41 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x5, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 361.559437] binder: BINDER_SET_CONTEXT_MGR already set [ 361.580684] binder_alloc: 13336: binder_alloc_buf, no vma 01:47:41 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) [ 361.637378] binder: 13336:13340 ioctl 40046207 0 returned -16 [ 361.644750] binder: send failed reply for transaction 219 to 13336:13340 [ 361.659199] binder: 13336:13350 transaction failed 29189/-3, size 0-0 line 3035 [ 361.660364] CUSE: unknown device info "" [ 361.679407] binder: undelivered TRANSACTION_COMPLETE 01:47:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:41 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 361.767723] CUSE: DEVNAME unspecified 01:47:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x12, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:42 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x6, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 361.940257] binder: 13380:13382 unknown command 0 01:47:42 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x40c00, 0x0) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x2, 0x200000) r3 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x1, 0x1) ioctl$PPPIOCGIDLE(r3, 0x8010743f, &(0x7f0000000240)) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) recvmsg(r1, &(0x7f00000004c0)={&(0x7f00000001c0)=@rc, 0x80, &(0x7f0000000280)=[{&(0x7f0000000040)=""/22, 0x16}, {&(0x7f00000003c0)=""/252, 0xfc}], 0x2, &(0x7f00000002c0)=""/116, 0x74}, 0x10000) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000500), &(0x7f0000000540)=0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0xffffffec, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[], 0x1}, 0x1, 0x0, 0x0, 0x2000000000000002}, 0x5000000) 01:47:42 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:42 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) [ 362.011383] binder: 13380:13382 ioctl c0306201 200002c0 returned -22 [ 362.111243] binder_alloc: binder_alloc_mmap_handler: 13380 20001000-20004000 already mapped failed -16 01:47:42 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x7, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 362.186853] binder: BINDER_SET_CONTEXT_MGR already set 01:47:42 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 362.208775] binder: 13380:13382 ioctl 40046207 0 returned -16 [ 362.248441] binder: send failed reply for transaction 222 to 13380:13382 [ 362.261480] binder: undelivered TRANSACTION_COMPLETE [ 362.275418] binder: 13380:13395 transaction failed 29189/-22, size 0-0 line 2896 01:47:42 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) 01:47:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x48, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:42 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x8, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:42 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 362.515092] binder_alloc: binder_alloc_mmap_handler: 13410 20001000-20004000 already mapped failed -16 01:47:42 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) 01:47:42 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r0, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 362.592490] binder: BINDER_SET_CONTEXT_MGR already set 01:47:42 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x9, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 362.622211] binder: 13410:13411 ioctl 40046207 0 returned -16 [ 362.651082] binder_alloc: 13410: binder_alloc_buf, no vma [ 362.689022] binder: 13410:13421 transaction failed 29189/-3, size 0-0 line 3035 [ 362.694853] binder: send failed reply for transaction 225 to 13410:13411 [ 362.719193] binder: undelivered TRANSACTION_COMPLETE 01:47:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) fallocate(r0, 0x0, 0x3f, 0x7fff) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="1b69030c9042"], 0x1}, 0x1, 0x0, 0x0, 0xffffffffffffffff}, 0x5000000) 01:47:43 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xe, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:43 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4c, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:43 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) [ 363.048932] binder_alloc: binder_alloc_mmap_handler: 13435 20001000-20004000 already mapped failed -16 [ 363.059293] binder: BINDER_SET_CONTEXT_MGR already set 01:47:43 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:43 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bf93c3e197b1fbe35469d01aea070000002196dfd01f8913ae6bfb70ffa94b631d3ac5937913696f1ea296e7b763ab3a4230f6c4eeedd7ffa0065d6807569d178819fbf9b2afda55ffe1399cb4d83546dcbd2a6ae0ac7ca0c2e01584e88bf3cae69cbb102633d2417918c35cac34589ca7ff6b7f07d54dd30e7e52d50528e43391b694f1158d2b34c298d9c04de66d8a607117ab828e735f9f0a4f0ead575fa3b095a09447abbf5f8630477d0c9382573ca98ef273d9dbf02e1a257faff3f227da6babc4b4e14cae82735ee85821525f4f96fc8b49b61bf28da973a7dc2552a4482fe8a7f3bdd05ce4faff62805c3878b38e52f84c4eb29ea2702b015d78009d3ca5d67923c744f2f6ab2c27ab6b9067dc9b8b235f28fc0abc7057b73b5c9ac93f961d935d0f79925f549940202ca97517e4cf"], 0x1}}, 0x5000000) [ 363.149273] binder: 13435:13443 ioctl 40046207 0 returned -16 [ 363.149479] binder_alloc: 13435: binder_alloc_buf, no vma 01:47:43 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10001) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r5, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r3, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r3, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r3, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r4, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r3, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x7fffffffffffff, 0x1ff}) [ 363.227617] binder: send failed reply for transaction 228 to 13435:13443 [ 363.287172] binder: undelivered TRANSACTION_COMPLETE [ 363.304436] binder_release_work: 10 callbacks suppressed [ 363.304443] binder: undelivered TRANSACTION_ERROR: 29189 [ 363.327888] binder: 13435:13446 transaction failed 29189/-3, size 0-0 line 3035 01:47:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer\x00', 0x101001, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000003c0)={0x0, 0x9, 0x1f, 0x263, 0x10001, 0x4, 0x9, 0x5, {0x0, @in6={{0xa, 0x4e22, 0x10000, @remote, 0x3}}, 0x3ff, 0x1, 0x1, 0x2}}, &(0x7f0000000300)=0xb0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000480)={0x80000000, 0x2, 0x800c, 0xfffffffffffff001, 0x6, 0x5, 0xab61, 0x3f9d, r3}, &(0x7f00000004c0)=0x20) r4 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0x0) keyctl$restrict_keyring(0x1d, r4, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x5000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ff5000/0x2000)=nil, &(0x7f0000ff2000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00000001c0)="f159634aac41b7220add5bce53dc1bb29a666b335d151526c2485c8869dff961624d44b881fcdd8fb05b30bcd08730c499c1fac4f8f5f27bedcc066fac4fd815ff3bf26df53c283243ac0b1805ddcbcd158807bb8a1bd7624d489605f10dd9466bead0eb3158fd78c17e4b86300e55c7c5f7fdc2beaecbc87e830b4bb60f17605c34cf30028b6952db69963f8f27ab5dfa545710380b3374e901f7f28f81986898ae793dba1e4faa8080eda7ad6b38a9acbcf904dba20f653adddc4f1314cf9eda6c56ae954e707d245912676634b17081f3165c70b76aa9b8dcdcd7a17eea9ec7c8d373fe593d381c93f30b121afa8331b3be17000da24e87febe", 0xfb, r0}, 0x68) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f00000005c0)={0x3, 0x16b}) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="7108168efba9a6e19c221cc7ca3e68c4adb20ebe98ecd6947eae9caf8808fe4cea7b06a3635e975d823a42d8044ac34d77944c704adbab5e1c1be0e653570bbaa44d8033665d827cb7011f518b377cc7bcabcad5595af0ecb8603b6ae5f701962bcffb41b508390fe56e54691a5e99e4"], 0x1}}, 0x5000000) 01:47:43 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x13, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 363.367806] binder: undelivered TRANSACTION_ERROR: 29189 01:47:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x60, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:43 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:43 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) 01:47:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x20400, 0x0) ioctl$VIDIOC_G_FBUF(r2, 0x8030560a, &(0x7f0000000080)={0x80, 0x10, &(0x7f0000000100)="ba11acabcecb3bb90d62116cc8b72fad9550c3882a6efd337ee59b2347c6e23dfc07babd660f73fd496beaa9a8f14e2289988a0b31268c904a1eab4f3ac8ba706763b42e0ed697d276cdc67c95e8e8945a6fa45157834bb7aa8f7798dd63cc", {0x80000001, 0x3d22, 0x43353039, 0x4, 0x1, 0xffffffffffffff80, 0x1, 0x4}}) 01:47:43 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x47, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 363.603417] binder_alloc: binder_alloc_mmap_handler: 13476 20001000-20004000 already mapped failed -16 [ 363.681483] binder: BINDER_SET_CONTEXT_MGR already set 01:47:43 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 363.747884] binder: 13476:13477 ioctl 40046207 0 returned -16 [ 363.777392] binder_alloc: 13476: binder_alloc_buf, no vma 01:47:44 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="fcf624514575267ebbc457f9bd35666cdb597ebad7e1fcabf2fadc5a32b9f16c2d383e9ee131ca115b96703d17428676eb35f398ceb4b3627747020247752c799367ddad6a3641240f747668e0730bbdf7e1a5a687722bd35d5e35a9bf3d5cee5e711c22d01105ce564e8cc1ccbda4790d1347e19bd8189917aa30c5ee14613cb403b964711d198eca6e034e5f3479e42bc952ec142c8a2d6f7fb4c2be1e70402f53204cb8f0cbb17a11b9da98c56441fc68bcff082b36681119ec23b0cf32240f61fd0653e5227b87aeb0271e005154c6093b5f53e87174abb3844b37539d745d901580749a567681106ec69882b2a67cc668a2bde5882cd325e97cff2c837c696ff5aa215151a410e590ce3b478845193d2721f6dd9b8576d19ae7f9dde3700cb58188de481516a4257121b619df46fc37ce075e9009321fc52041d360673b97fc2d4c11e4b189da0692387af028b44ef745e1a0412b555cbb387fc6624461d80de5f5a88b5e7e8735f7ba24ab0a3cf1"], 0x1}}, 0x5000000) [ 363.802586] binder: 13476:13493 transaction failed 29189/-3, size 0-0 line 3035 [ 363.847392] binder: undelivered TRANSACTION_ERROR: 29189 [ 363.867632] binder: send failed reply for transaction 231 to 13476:13477 01:47:44 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) 01:47:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x68, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 363.913785] binder: undelivered TRANSACTION_COMPLETE 01:47:44 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x60, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 363.937541] binder: undelivered TRANSACTION_ERROR: 29189 01:47:44 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x8401, 0x0) ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000100)={0x7ff}) 01:47:44 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 364.035086] binder_alloc: binder_alloc_mmap_handler: 13501 20001000-20004000 already mapped failed -16 01:47:44 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) [ 364.127867] binder: BINDER_SET_CONTEXT_MGR already set [ 364.136602] QAT: Invalid ioctl 01:47:44 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 364.171543] QAT: Invalid ioctl [ 364.214692] binder: 13501:13504 ioctl 40046207 0 returned -16 [ 364.214734] binder: send failed reply for transaction 234 to 13501:13504 [ 364.228915] binder: undelivered TRANSACTION_COMPLETE [ 364.279459] binder: undelivered TRANSACTION_ERROR: 29189 01:47:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6c, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:44 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:47:44 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x300, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:44 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) pipe2(&(0x7f0000001400)={0xffffffffffffffff}, 0x800) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000001440)=""/126) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000280)={'broute\x00', 0x0, 0x4, 0x1000, [], 0x1, &(0x7f0000000100)=[{}], &(0x7f00000003c0)=""/4096}, &(0x7f0000000140)=0x78) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x200, 0x0) ioctl$BLKROTATIONAL(r3, 0x127e, &(0x7f00000013c0)) pwritev(r2, &(0x7f0000000040)=[{&(0x7f00000001c0)="57721be1814a46e67b0eae503b1f706f1a83ffae5a8ca4e3fb070284edfa09de70d4fdd05b9dfd5fc96e5f17bfaed9ab354301eba62bbf52fa8721fa762f3857e9af8b06f4baade85bd9806b1d4247c5a4990750a4b4d9330d10874e0c1f51e6438c4d312d3b59133ce5c3709ee73a8da440ff738d9e0b91d0e8b6998ebbfe52e06086b1ecab2056cbb3b69811c0a1c9aa7ed735d7c1e6accb08c61167f8bac6c1dcaad988e391ba781aa932", 0xac}], 0x1, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000014c0)=ANY=[@ANYBLOB="dbe9b46179529d6c17f881dc049ec7e03d2cbffd0cc1a16d40bb13a11a2e1ebff8f2d210b2d414026e7ce2fd2986c3fd39dfae282cb5f918d37e84b4907a2bf2f6755af0bb5a140665d8268b412a7bbd587e7f32ccb5e5b041ef0c19b28475306ad2673d1c63524bba114238a892196ee83dcb5e6414cc303b9f0b0367b2d72c98da4e6109b06b4c2750ee8841b13771165ae87e3dac146ec5ab9994cbdfaf3edcd75c044c00af223bfb84bef6524929f58fbdb62db621e514a238ea0ef6ae791b833e90ecb4bb42e7d9fdb90bde2261dd7cc7a3e6e0eb2ba4cc66bb16b9c17a009b11ac2f710a895cea3bf85c8fd84886b6696215535ff087edc4094f58aa9f92c5c292eb032efecb948bd47dd2d2a3d90c848e8ee842fa7363bb28be8601eafba3e9d02a03e3cd3a20a02db89f46a018f95f83eca8f607217a5e1766fd957b779010094d7b758597d84969913b7106a0fb81738677c6609bead7dc7e2e8c5859c9ac49f29106ac8e54a13ed03898ba61b11429705af8576cc4a32c3eb7042c84335e9ced2ab2cf435a516162328c94fb49648aecb74493364de64b3ec1ba0e"], 0x1}}, 0x5000000) 01:47:44 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) [ 364.501466] binder_alloc: binder_alloc_mmap_handler: 13531 20001000-20004000 already mapped failed -16 01:47:44 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x500, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 364.548856] binder: BINDER_SET_CONTEXT_MGR already set [ 364.566344] binder: 13531:13532 ioctl 40046207 0 returned -16 01:47:44 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) 01:47:44 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) [ 364.616687] binder_alloc: 13531: binder_alloc_buf, no vma 01:47:44 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ff7000/0x7000)=nil, 0x7000}, &(0x7f0000000080)=0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) msgget(0x3, 0x280) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x200, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="373cef57352a072e5ee7b86771daf9999f82b65df997b53dd04fb2e8b13c0bc52181d8966ca367a78bb4bc75d0a8b1b648207ef7cbe25dd871248dec85e91de17a4ffab2a5c1cca50dbfe66efc4485bdf9368b35f62dacb12e7e57fc5aafc9f8b33b956c3b5ead674ee956a9a22973c8ac0ce1c6c0bb9dfb90a2a0d66dfb898f8942e42ea870c09a33137ad06c2373c1fecb0b8e0f73b8f303508b168d40d81697da8bf02ec69a85bfeb0cc0256c8647734f820cadbdd02ef6269ae0bb55a5a452546a6cfe4558b2e3517ea5dec13ad0ab521e8ca19a61218b152de1bf508fcc667d0b76a0bf03a157d64e4048fa554d77a919d35c5e7029cb1e1b25f351a78967f14a616392dd132dda7889a5c5ea131bef0f7969370e52048fc2"], 0x1}}, 0x5000000) [ 364.676962] binder: 13531:13543 transaction failed 29189/-3, size 0-0 line 3035 [ 364.688969] binder: send failed reply for transaction 236 to 13531:13532 [ 364.746181] binder: undelivered TRANSACTION_COMPLETE 01:47:45 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x600, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 364.781099] binder: undelivered TRANSACTION_ERROR: 29189 01:47:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x74, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 364.822219] binder: undelivered TRANSACTION_ERROR: 29189 01:47:45 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) io_setup(0x4, &(0x7f0000000040)) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x1d10c0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x12, 0x6, 0xffffffff, 0x40, 0x2, r2, 0x258b3f63}, 0x2c) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) 01:47:45 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x700, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:45 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) [ 364.965849] binder_alloc: binder_alloc_mmap_handler: 13563 20001000-20004000 already mapped failed -16 [ 365.045579] binder: BINDER_SET_CONTEXT_MGR already set [ 365.092779] binder: 13563:13564 ioctl 40046207 0 returned -16 01:47:45 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x900, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 365.164500] binder_alloc: 13563: binder_alloc_buf, no vma [ 365.183881] binder: 13563:13577 transaction failed 29189/-3, size 0-0 line 3035 [ 365.193125] binder: release 13563:13564 transaction 239 out, still active [ 365.209714] binder: undelivered TRANSACTION_COMPLETE 01:47:45 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) 01:47:45 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x210080, 0x0) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000200)=""/23) mq_open(&(0x7f0000000300)='&\x00', 0x40, 0x20, &(0x7f00000003c0)={0x1, 0x0, 0x9, 0xffffffff00000000, 0x1ee, 0x3, 0x92, 0x5}) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) connect$packet(r1, &(0x7f00000002c0)={0x11, 0xd, r3, 0x1, 0xbf24, 0x6, @remote}, 0x14) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r4 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x5, 0x4000) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000140)={r5, 0x9}, 0xc) [ 365.251591] binder: undelivered TRANSACTION_ERROR: 29189 01:47:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7a, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 365.299908] binder: send failed reply for transaction 239, target dead [ 365.426654] binder_alloc: binder_alloc_mmap_handler: 13591 20001000-20004000 already mapped failed -16 [ 365.471242] binder: BINDER_SET_CONTEXT_MGR already set 01:47:45 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) 01:47:45 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xe00, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:45 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x2, 0x2) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000100)=""/122) writev(r1, &(0x7f0000001540)=[{&(0x7f00000003c0)="c84f8a7844730ef608457b1597feb9d36ebf1866a9a4aed660a7b7d9c952089e2d95f668d6ef0ff381bb9cc6ee7f9256a42988757a2e3327af78096f6c74d298e5901f25341a69cf55c1c046d585382a6aef2b389fa9026655e40fe3a1bbef91053d69c03406d3c8375c4728328bf4bb3d49d3ca80fe6b0907d0c19e95da1d3dd6d428ae6d9d93a6909c28190360cf2245861ded4e1dc922166817154859d9b5d6d120a9a58194e3a509ca7e8fde236ee0082413cfc5cee9e8269f2610ff0739a57d4e6dba8c710dd463e7f3f536bf6c5c8cafa5a6ef7ea0df6b5f723b77cd20ef96dd221bed546c344f95401bcbd887c7056c05e740daa92dc9fb655761123fdf142076476495ac6cd1c6c62f45e6abca602c5cc3022b7f6093b82fec3e1725a325b0c23a3a46ad8facb9ea9c147bdeac2a820ef83bcfcc48b6eab8ce964026ca94c2871d7fd31c1cf5dee147fc9170f3df7d96d97b59b6962fc352c4494591f4e84125454c96e17221cc9b2b844b89f7cc7382612cfefedbbc669712186f8311a0493191843b2214ac32a862ba07ba59ab7d2b8afb1a3dcffce6bd236831398d921a06ca49ec66beaa87c7571c8ee727706b46c019124dd879d1e97406c4bb5f5a0a7da11693ceff349deda1b374b9d53ebc0a40108c42cf705bd1225878a532738c8c26cdb099414c9ae5ef92dd747579203ac3adebd4cfc2941200f7cfcd7e005ca92e0b3eec2d64ca810258f73d8abd0de26579e73e6cec737d5220460f3bc1aa463bd3e165c85f8b7f6e41899638fe915de2de749a62911848142b42028c2c4cfc110c8acc6c173a13877bffcd5f4b4242f5c1c9fec30c72d0ee15b85ac07d58c20ae77262fb12445a517e1db3510c4feac9f322f78829fb95ed3422781eee354971702080b977825517a56f14ad9915c360c4abea9a1d1b9f1c3552ec4a79d1b145f3cb6fff8f43bb425c929b29b9cbbaafcdb0424bcd8d288346ae942491309f4d93e14aa920a1047469c1020532248a7b0c1f9b9fc1d233c7bff14a8efeec2aa8d3b71cdef8895f31f27abd2c4f60daaaf0f0c6015961e23ec947b3459523c6bb589091de9a4023f02466b0d5a3142b6ffdf52613cc8ada8109929cbad92ac86ed786bba253e069b4128da29beb665035b974c0d027d2c7f73b61782d1621ad4a364ba9e9f7d23313edb30907f932333debb6b896677c91749abbdfe27fc289a68a6e35d08ad3a115d5c183bbedda1cc43567d2f5b341319868a3c0d901ce892510a0b2a4411397aa6913cfa3a0fc2d85403d6836a43051ec57cb39a86f21324334e1c8e079ff639baea546ccc80fab2d9fa9629fc2e1070587ee87846adf100646ae22641768b9accecfa660981391cc4b92bc0610b8b41ce4edd2a24f64b50fb72f3447d16934edce794bf50b297625c2118619c4b5adc7622c084f46552b249756ae718920b9feccb06f24b0dce4dfcea5690aaf84b52ab4e0c50ae020b54202cbf45bb1b92c8ef5c368da77e46ad9fa19562cfd2403c12cb8bf1628778c1ee552b60d6b0cc259d4afd6f24e50e45a350b1a6b7e0ad32be3ba320963a2613f7bd8e31c61e97fea6cd7469cf06127038dc9da22430726c25ce4fc44653315efa59b2f328133b07221ffdcbf6b5eb06899aa0344bc8a28c3ec6ba0fbef9d0d3a0f0da98070b7b7cceb252b85eab117f40c32a5d45249ed79540866c4248a1a939f01a574e41c3385223b3f93d355a904293d364c5fad56eecf47ee9495e18502edcb4b348966cf598bf89a6cb713c57abaa1c9516270866940bbc4c4c7bd6f6af13210155c80f70a5afe55c11b0005f9d4d9a17bffb1a4ffad60d50154502977c0184f89acb3f91febb7e5f82e6b9cc1629d6bb52de481ec7f3f5166c7a18c3e9017f74eb55d56f53ce9e40f7703227c0eac540f6f4d4b8ba188f56c15140b3cebc6e9b5aca2faf7919390d51d8f115e34a2ecb0a73b6a897c09921fc6b9cffe8a496b2e02acbb3950ff80e7aab569cf64666c5705482aebd4992df2e018a8e7b34393fa16ef9e1577f673992e23daf9f0c8a311fc022c5187ca08aa487458a16342022fa8f45ec23ad7c3539f404e4ffa72f758b515b49b29e31541625d7ab9a5dbe1785ff757c0019eea8f90c367c53f5502ef64da522625c5a00a8eea56f95b83824350c60b340f87888cd472ea0e1453d1d2f764857ff8e182c0a02b074ba7f63db9e4b85e72cf53c16e14e61d750a7d1f604160d0dd0cbe59345de47a53f096e43c1e62d25065ca355d903ec74e501631bc036324b82144392b65a227b9d3bd1ddd30284c183c11aca648faf3dae154d1983961ccafd7579d70f5d2d1142929fd9d6ad4ca5f4de5e409043192ca17e0756953056de8f11015a85f37d44f211b73d764c7a2fe9bab8c7b43c473def2ceae1105e91a81d0a900d63c8f6356d2d4e505fa7ced9829ce67f80b6f78e56b3e644637ceb7bba7371b2987b430f4eb29a4788c6588d69b05a2819f12c51463a81f9e0288ba442ca299da2c9efd77d3e9d573a71ca63e4b514b8bbba5df632c0058d58c3e3f603d764bac16ee05890fb9c7b5ef2aeaa8bb377456164a303089de429c663aa72db9bde7564f9ae80a4056b1a8c610ba5bd5a72b1047235e35f5bae847ada4cb120c2a8ffd1affa8b881612b8d3cfb6d7fb77706552c6a9bfb9275381c8fd428f979121200f77272b4f331de7d4c3280b866bc50ccdc929433b195df2b82ebc04a9f9e4babab907022e20f2f2bc6a9faaad1d61f8cab81b4e3fb762be224af5244879018a28f4f015fa5db835ab300e1ac14617f1d654eed97f8bf848c4064056aa2bbee2eb1db6e022fd66c67f2f30708ba271fc6dff084955a5781a9c0b6515d70c8f8839a48fa7958f6a3368da09e323a9f3bc8fe0698ee3f77fad276d36d2e0954fb9300134742a52f2f00caeb017a3701caeaed653efffb06127dcaa4c5138cd078d7b39103d50c6b56a293befaa9cca44c7719b7602860434616831936e02176b1bafb9d1cbab878fd390db9d9db9994b6636f040ebc0c523422f2c27a65603937a78134b643f2d02e1cd5ee47f74d3a8027e714e77c3112911fde1c0f8d77c0f1aeb056e585ca95d1fd8d543c2614d5fcdbea73dfc13813cb338eeb621cee0b02852fd33b87a019535c0a71c88e553337609c8229e3b47674bcbc80afb804b1d174f0376217c1f65cee610bc4534f86c5f26044a686e3a53fc06c60dbf918cfd07efdb33fa6b0ce2ee57162b5ec08fc433b480d26ec470608a81fa8216fdc3a757857615c6ac2247cf44f636c97fd714d070378f9b3810a7667cf82a6a8b1532a519f1d592929a07f9ee3537a60182e5118ea79a6667d2c0a582b4e02274b667e7916172e331136b6ed322a5882316d016c60db0149ba104d8a784c191652e540cc52758e1e75d308234cdc6b359dd58f4df1b1654022356d94577d1b01b53591cfc1cf1e28d2e3ba572f9877e534a2d138d10f8bdb40b2dd7fa259674850a4d316db922c602264a1082efc6a1994f4602fefcbcecefcd935e330336b41a068342ed30e371c1492f4c0ef3d381675547dad07856b13aca022dfda215564f29b327082d066899613d0056a670aadd0375c7b00b1973b1cdbb15395c3a63c7d209fd28a496dccc8cb60bca8015435d05b58dbc645f8552a46b1bd5955cd0e53eb9fffe3727b2989ed71695ad78a60d0d01a094223b3b480aa4a3f5434b0eb2811b2eb61e4f2fe5d206297f9ca813dc6872e7c7fae056eaa0b092cc1a05862d72c010280a81da679ea11177579c651171ccf2e3190758a258750d3c812eff70616ac43def48671ac78d801535226e8a502adab8721f87f6b18fa3d716678995be55dccd6eec944533eecea387c3401dc0608421be94f38b3578793cba962cb53cb9be163a60ec09e2bf60bd1782ab87b208f1b42ba8a682fa5b1d2dcfecaafd766022e04ed0b35a97e9eaf3316476a3aee761ce461929f9c61465ff1cc84f9b8d2bc8b4e3b3937547037bcc45d52fc70b4813b55b42d21433c881d3c58b958e7a2d04912285cba4c863512c81ea81d9518ddff4389f95ecec8aedeca35d0a230a04f17bd82c96382ae90bba20921b8e86c4cfaf988d03a0466c982401a395d783cff85dedc19c793270058902d3756d32434057a7a5b9eb1ef51e09a1c2278a4426d6e4b8bba9f2aa426332643730826582f96bc845b039db6d1034f5679724e247bc3c2b55509b522052c68cae9aa075d52bda8d7388355a0c96437529286e61dd35ab8aa07c50bbb7ad46f36dfffa0e3198c92c8e730f60cc04d88ed79e0ed0df051eb61e25c4ce9fde16b54e4ff51a89fd43d90c84be886fd41089a5f970e0d0552af10c2b4043d6a755b5be618ee1801ac561d0936118a5368ef2f9ef264a4e2544a8cd141b337fc775a746f2fad6550d7ce7d3c095a6e660f341e839ab8c7895fd0a9128f719fce1845d4e3a0da8c1c50c954bee53f3302257e49469ed9873fd7446754980665237183955009b8d117c6cad631430e44e45aad5e3c8a4172231777f6a4e48c2259abb8247df249be4bb092ff3f3a4a74e37a67d62e9c19d844907baf83b924004ecacdd0943ff97ca1fb71c8240014be4fc6ccc02cc0d6085fd365c57eb16e67b83fdefea3aaa3b54b05eb2e342c4d5c8e43e65f2ee5164d26f881193a93a9ce0d139faed51ee29ab87773e3e14e7446276f47e4ed3fe4ae7576c207d41c8ad47136bd3d9b3c9e1650213bfe48750b8bd1351ebd263ae489fa645364dea861079525e11ae81a13f4c0250fd4f500e7650ad87624244696b09354c4dab3e687f81d99267b88bd892fe36dc16249aff1b8febfe5cace9b7396176a8b038c125677efc682d045b6535bc3958c718897d58e825fc93dee37ab881a2aee27917eca4357ad78567bd1a31e7166a1705572ad3b0023e188c6ad9299d608325b62c2e9da308584898f160866d33d184cea8720ed828ee5072e0c7bf9027fd78a8fb7271516dff40416ffe40b0dda4ec06430a1bf48525b007647ec10249790a5cd5ed0738fb5865967543d45e4e37ddd1cd74a7ad15c69182123435e5d7b2dc8ed96707a738f39318ef49c376c1d4dfa8b2abd5339a98850c48259717109cb42c35431865f406cfebdc71dfe168c2d3a95d4b421551d125afad5280346ab87f13142eae547752c5a2375ee3584d1e48d269b6d85392634851397cb8e81927d84174ded5b2d5a1bcce2bcb474436d8894399d9da9dfdff621c3aa5a36b00d225db33ccfd105dcd4396c9b9cfb60e9a82b30ebec30538bcbfbf034982c7e4210b400c6117c5346f8c429a03aaee9a05df041a2f5ec00afcfca27699d473d17a46de5f0ed435f05243510e6de93bfcd5609cd9efb0c6fc43d308f5872082285d0f2a5f152fa6b0077d8f3bf0638c0b796cfe017d3b4edf78cb4f5812d81d55f93009641d798459f2dfd581b9fe459cf4451c90254bf41405065f164fcfb0ad1e3ccacf991769217a72bfb6738a5765c37ff6e10b0c0c9469f9be3d31444f698a567ce3ea2c135f4cce879dc70e17bb98f6840a68912548f591a99082463ab47d8b9a9b070debbf663d0c2b1ad1bafbc91c6fa23d8be914c184106c646aed997d2663d9aa532cfc0f9de3cd69e1b5cbfe2185d9aa2daaa7c01f87f034c305024c35b11b8e309c97a0753b979647c9940a45963f17f103b3810c6609c37521974a3e9039719e5b2828014807bc460dcca882d04ba7f6fa32943126dbc6ef8bd", 0x1000}, {&(0x7f00000001c0)="8797e253b9e81ab9023276e46fc3f62565522d531d4d893d868658dd41f313f992caf1033a72801ccafee700bfedab7e88b62f5a272aa65b0ad414a2643159d308f1176b9f35456765d66f0ad5589248fc4eb9d9c8ed181d73e7785d3d0702045e3f8340764fa007f02118f9287475c23e18b9741e9f0dee0bbc3bce5da9827cffb021fda28dc0e70e363f9180f94264e46603a987444727521b231f247bff541b2ca938fffe4ad60924c55c3b06d2683bf1bcfa50e11bf3b364dae5c6e4b1135a487fe94fd6d6256e6e39d10235b2eaf77e3d1c30fe001aeb8408e60f17c4bba7504cad6b5704", 0xe7}, {&(0x7f00000000c0)="117bc0a209dc87a041f9c4a8a443bedbb1746efe", 0x14}, {&(0x7f00000002c0)="d48b854c7762afae0ab8cee266d925d274c735de85e40bee9b5ff5267f78f6ec76cf809a1512b3dec034427d9ee3549b88b6f1b2093ca88568452517645a906e75f98e604b5fb742e867d46fba3b267204fd862fdd66d4c0d8df928fa64b373a4f4924d940c60bdd7a20", 0x6a}, {&(0x7f00000013c0)="d7e21b31f37138020496891da3ed59bb750c0416b1ff134b9d6609aba1949da1fa4b7e5470623df3f3b24c0b324a6264c6ee5e75dd96c12f6f428f8bc19a7b5b7a6e65ccec737e9f992ea91e68bcf5e16da1a7deb2f1ef1dc994d02445569e564df1bae45ad478a9f1702d93d2e418daef5c9a675df91393cfc2cc99a0b8a2a0debfde7f0fdefa83990bbac9c3ea12920946772cd311babe87e11a5df60e34501685d60cae35014e70e2b3fa3a08f3a6c1eaddb57d91b0e6d99d855217f835cbd9dbe76b870ab9abdc724f15134eb62188e7ec", 0xd3}, {&(0x7f00000014c0)="74321dbd234ac922efa0925f4bede59cb7a35dcd73b1e1258264a1c2be5458b76f4a97680736bc4e5685cbb08a67a36672637d4d913657612c27cd69ad0d352ee3b81ece94711e62db0439fdc23371d829baa7a73a1d4d05c6f674033c96bf0f98835a5988bc1607a3", 0x69}], 0x6) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:45 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) [ 365.521374] binder: 13591:13592 ioctl 40046207 0 returned -16 [ 365.623460] binder_alloc: 13591: binder_alloc_buf, no vma 01:47:45 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) 01:47:45 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf00, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:45 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0x2, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x3, 0x0, 0x3, 0x2, 0x4}, @call={0x85, 0x0, 0x0, 0x54}], &(0x7f0000000200)='syzkaller\x00', 0x8000, 0x94, &(0x7f0000000800)=""/148, 0x41100, 0x1, [], 0x0, 0xe}, 0x48) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/btrfs-control\x00', 0x12880, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000340)=0x2) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x10000, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x2f, 0xa2080) socket$inet(0x2, 0xf, 0xcc3d) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f0000000380)={0x0, 0xff, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYRES16=0x0, @ANYRES32=r1, @ANYRESDEC=r1, @ANYRESOCT=r0, @ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYRES32, @ANYBLOB="704ca676a8c36b60661c2d631481f2a08f43fa6c51a0123d1fef55ebdd0cd8b787b7a4499d49a034d314ad9d4aad9f8a3420ad115ac5d8fc36ad757303c0973b1bdf5d85a222ea241641bc6a815f8b4be1143fd71d56282a6ea7fd48a17223d1e5172c022a20c614e6415f72cd5dc245dbc8edb965003b121376fbc958284a4ba366fa06743c5a3f69f198fa913a8fe3f388389db308e20c748084fc06061233736a4d46672ab417391d15f0dad81b5f", @ANYRESOCT=r0, @ANYBLOB="64a1e959f6667121152ff688f7691e5fcc741b55dd85ee01fc86d65996e196595979758056e59a71c8742161c4db3b60f18c3984665f51edb6a52b799eb74db5ecae8c63977661b4ac6c249fe20e8940cf3efd839649a1c5568c7586a439db34438920c4d59e32cef76685b8fea9e85f22d5a24aae749a22e05a7c636787b49946b8ac6190c751959d2bb28086bf43d23ac05554ffc3c5d7286c86830a3f0375bbb4134c91bb8d512e4b02e78b79", @ANYRESHEX=r0, @ANYRES32=r0, @ANYRESHEX=r1, @ANYRES16=r0, @ANYRES16], @ANYPTR64=&(0x7f00000006c0)=ANY=[@ANYRES32=r0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYBLOB="58d09df8d84f493c88613f3ea8647e323fa2d340867d4cd6d9ebaa6b09fee1194bf4634cf2d24e711afa06b082fc62a7ea1eda126811436f5b3528d6973ca1c65f87b87ec702f406eff4987e98cd92de8d9131765aae391e9eb355cab8098c6e92c88c2d101a3554d0aad5fb61c5972edf8f096ac67dd18373a730c51034f26933a2bfa63cda89ac7ca008d3728828075e5f28ce2338fb1dc20b2e18f69d06661292ae6541248bb767a3a007e3054f0fd4fb65dfdce9c88e49a84a790df1c22c03918ced1191926fa313fc91609e179f870a84a6b676487412fc2ccdaa64dbd8e1776113ae2de172456e392b8c3657", @ANYPTR64, @ANYRES64=0x0], @ANYRES16=r0, @ANYBLOB="4966fd06c0ffde472ef0474aa6268f18ad7debeff765cbd35e90136a299a0e046129cc7abfefa92433cbd25e6015b0090093346d88179495d670c3b8669e1d25277797e3a4065ceb37d4adec0b5d159b2812aa4f17c228e0e1c813a55a00f669d5d9d736837787226c053ea1c1563b675eadc47d0df38ecf933f448ea0a21611ffaf79ffb444cf6ae28626df7f2b1d0a537475d5dbc22a0830c751098035740a26333efc435c3be417cf20bfd27758ecc47150167be7687749d70998ad182b7fdb67d49189943b5bb7cd928ef307e75f972efaa04f8f9a07eda1befeb60e852185d130dc15231e53256c0c02bdfab6360701eeed", @ANYRES32=r1, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYPTR]]]}}, 0x4fffffd) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000040)={0x43, 0x3, 0x9d434429e9f51783}, 0x10) [ 365.679506] binder: 13591:13607 transaction failed 29189/-3, size 0-0 line 3035 [ 365.707867] binder: send failed reply for transaction 242 to 13591:13592 [ 365.755067] binder: undelivered TRANSACTION_COMPLETE [ 365.786472] binder: undelivered TRANSACTION_ERROR: 29189 [ 365.836209] binder: undelivered TRANSACTION_ERROR: 29189 01:47:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x300, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:46 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x1300, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 365.941433] binder_alloc: binder_alloc_mmap_handler: 13622 20001000-20004000 already mapped failed -16 01:47:46 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) [ 366.045158] binder: BINDER_SET_CONTEXT_MGR already set 01:47:46 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x100, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r1, &(0x7f0000000540)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200010}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)={0x294, r2, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xee8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x200000000000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x101}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}, @TIPC_NLA_LINK={0x104, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xbea}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe915}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf74}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x495e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xcb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x45}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x38a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb7c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_BEARER={0x30, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @local}}, {0x14, 0x2, @in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1d}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x101}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xd000000000000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}]}, @TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}]}, @TIPC_NLA_LINK={0x54, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe0000000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4fb8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffc7c8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x30, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xe622}]}, @TIPC_NLA_LINK={0x40, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0x294}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) fsetxattr$security_ima(r3, &(0x7f0000000580)='security.ima\x00', &(0x7f00000005c0)=@v2={0x3, 0x1, 0x10, 0x1000, 0x1000, "cb206ee2043252f0941222289828c5d67ac16d4059bc3e3c65c8affe8ff801beb872654e6a47b2d3287cf1c172b1db8a2a8277ff133f837c0ee5b79490644be0a46524f6c6b60a181221c73f1a53e07cd604511651867a3b593da43672b8e3166fd763f3e2c933242680f2a18f223e2af86883b8b2f76fcf5a58b3f75eabd12a7aa54d37f73a084955646f6e49647197dd79c1fe82342b00c249910e98dc69fafc787d970bf3c9c10886b0282ba82648c29965daf39c8c45ff06406692583c14f145812845502db7e5fcd01b30c829bd1b42923a83cc933c7ec1ba5e6e1b2bbebc0d2e977b0454753c72a437605c8b58d8620a7a8429cba0a2ce46bcd8d453c9cfa0230f1b94fc631e35a30016ad8bda46bbfd12ae7e5e9b85a60a1de1168f906b14af9910c20749ef9ddcb7d35cebafbf37dc5325c4e6671b68ff72edbac5f9cb4a280420f8e180a20be0379c2636f78094c7628399c047ac897a2afbb1701b1df4b93f57cf42fe77c244382ad308fe8d96610aa6b281977842d16fde044b26694a0bf61bca316438aea54f16d4d5df3717d7f547d712b5c5a70764e69b76adc0259da271698eda5adc65928451503792a36020f0713954ef3a3339721e354bef452dc1a5e93e9f4a79aec1e1bfbcd03eea8dc099377142564800250e9b13b5a5a9cc5bb3c62bd761f846b762fcb4d5ba8762e8d06f6a344e4653e0d29356a20bca0cbaa5e63fd0f851c2ae60ea799e6806acfd6c7e7b85787cb49f8e98df91acdedfecf1d303ff0b6580ab01eba9710702540e236f0a1c55f9b1b22437e087f8687eda3f0e3e6fee818a54e6e19814cd5f5e6f21571ab9e045b0aaea61130117ef76cb95d589555acfb21353c188ebdd8b3413fc950ca7c627c1d3302b92c171f2e5cb515986a9146a044420b98e75a9e1491e369f46404af04236b362b479455b0d9eac51f024d78de621b8c6184db1123cef29eca4e818fe13d84b6868bf0ff69743e9239560d5e1dbc35cb1492db472fedfb815b998f8fe710d6db3e937768b2185fba281c6a7c5b749898033f02f67a84f8fdec6ed20f307de94ccf7b04e371f6ddc9a3172baff6e7e88f8db183b70a5ff56312b3fd639b855079cff6ae3e92ff24e9a3560814897e567b856fbd43f1863b8851081c1c6c4eec72caa667e3699d01278e5468efa30110fb090b8ea02e203040aafe03e343d632839ab67b4f06f79041dba39ee8445c657753b59bd1502254af3710efb65ec9329e351f4008c2445d603defc44a2de95301cdb51f94e450a8f38c0a11113dcf1ffe5b35abfd1e66a17181fe94b2a27df5ce959350d0cbe90376d989dae51b8e2d329e135426b5293bf6bea1caa5d373dac5466f55570003df66abb0ea3a650b9c7a7d8b377bf6919a9ea79f1479e4d87e14292214e4d81685d0d58476dae2a9de5002ef316cd0919b81eb920ca86858b2fe4038a54ae580fde15ee20adee38e19dbe44ca5e69324ae994d176b985fa9914c46d3d5571aac829bfdc8ca9816da6807b6efca4a19acb29e45c7279077e26ea7b0265eee01f6a3f7dac338de1da03a466529b83f6bc87e944daa83201e39d4ea1d8146e61eedcf77fa232b5a324d45f3607e8389d01f3f94df37d747b10ed7fd25459f6559a48b5e02034f5f55503cc10a3d3b977298519cea7ae229c67c2d397fa80ba1e4107c131d1002ffcd4114070eb702484d85366c0c2f36c60650ca35c15bec0777f4e28cb12b0446c3068693e15d8e73a3c51967c14cf78a7eb7173561d8295c1de9fb8f02ac3e18ad401e996bcd77d5cec2db94d322fd554d0e364fd4ee00553bc32055d06d11fdd5fd1f397a31280ebf241327476c30288b29593e6ebf83d5d48eb60a22dc9742a92684cfefbe3c976f6a66bab86835261cbf727b36c9d634cf02aaaf0d27d6580e512f2e12b509d0d4efb0471ef6732fb6063fb7f7f8e0c28f612b91484b1e1ea56ea3a4d0cbcfd9d533c762de0247b4d888c8cb631db285100ba780aceb4433869d71a2939d3909025adc09a27af2e260764b35cc88dd59b7a2e8fc8aee6e360ff90fc7effae71299746247b6ac08474c32b877ccaa98526a92247d7cfbd5859f38eeff550154be5bc555107c7575222016084448f0f262d45cb8a561d26e35498ea5727b0dc547b2bf5b8d8da76ed096a30eb43cbcae43ced239b52eae1818d36a30d4632904b57e67b9eef7ab12e571a0b265a8cf9828028e8acee82196a5342793c6c9a63b7a676f2d5d9937468c2b274abdf1f4a314adf53b4c3f2f3327dffb1f755a7826a6d66a94963109c03eb0c14f7f56b80fff51c2d11f2919d566bddfd21404adef73f73dfa78a8b3d37dc836baea78b622da8667dfc53b98aa6e8f30807fab2d57cc31d299ed47c47bcc15e54521d8f27b4affa652a6dceb4900929accb05f84b84912364726a71e1e7c7fd4d32d4926d1060068fc5c7ae2063a84923618e650246861aa36f3a54443968477361434f476ae52d7235723bbc4da726ce71271748864fb25f99320540c24a166b8251a86bfb9682ed2789d90972c11baba0d7b3ef4fbc8f53e45d455641e699da002204f307cba50f47b19fbe1e5fbf84493b327434bed2bf64c0bdfac055c4b6d059ef2f2495462fe2009d75fe3cc39c0a68b79da61d7798a0e7f2c747026063ae4635add527a06b065035307963bcffac9a07ec6bf1364fa287b69426080071e40c38873b3f2ad482d454ff67ca44d069aa8b54d8244fd12882d70ceb71df1bbc739716226deec7197052e1c8a1d451357e6d2c3403abfed61ad400b0f16c252b4a9405747ba4dc79f61c52cb3eb1389b3f91900b639c7dbda6eb296dec35d5d993698d54464192ad3def987ca340629d9a17dfd79093ee0d5c2169e3540cd92b3ab5ede4017d42284818e9a0c2db13ea8100199592dca769924a5e7e36eda2276a803915f8ded62bb41b9eb0357589d050384fd8c420f7160f08f2e11fc043c8d84b58a2798a5d1582e7a04f59401cdd813643ab508bfe08bc768a7e686cafdfd6339bd9934012eb8bc873557ea66ea9e1d68104bca23e5b81016487936ee25939948a6d94d9e33d24a020e768823dde7e6ff02eb23100ad1548bcc21a3ef0b089f4bc9eb87803941b760989eb22d77063f602838816372b2a0c56ccd4b6cb47a1ff6c215130bcf067b72a6c8dee8d6576298b44e85a4b660434542e4fa960df26a1bf3971e199d07630921261f43cd08b69e650716fdf672985ab5adbf7937f2cc2cb8fd1f5bd5bdb10b1720c00d7df23863a7f0865f0ad9929ffb09e0f0de87def107a9b22a16f18b3ad07c7594e308c6dc6bf309b4e117ff85507f8a8d6cc1f97a3350536566952cc559907ed316be021d2a855d9248f1bc3a9eb66c5c26e86ec31d92d3eb387e1c5e94c9a130d8692c5825869e6257031e2095aef58a691aed4dd4caacbe9effb3f20c34618b71e8cadc8493f533ea3fb1f6076ac1f5297cdae948674e114004a8b47f886b6495867269bda165019ea87e2be0cea4fd11da610cc2924f41d87605b86b989d462664f8d6a5d58a1d243a7fbdd336cffd39a9dfe64cb6ebcdc20bb049c1e7320120a6a7b7ae38842091ba7831c04f17cb1b068a18b533e398950b90a4e4d2e2c2d11ed58f7ce3acfcbd730dcc1a3df312c227329fab523e5dfe7caebf53d62d6aa4c790efa741618df485b4120993c9c32e29a1ac10c01c2498c001874f8475b4571e4ff6e33c9f443b38abcafaaa5e1186b21cd06d32697016ca704636bc679af446f9f81c4b5d5a746d23f431f393c3b7707ccdb7b373f11d98bcf923fcf7829f7c9feaca26da2e2f8f8ed213f838ae09069e55042d39d69c08a9c6fbab6c8fcd4cd1159e51272ead077d509b06435961f8c03002e1b293ca4b3fb383cb258f8b2f3281588cc634f9e89c4e21a276b2d9cfad9faff363bdff7e3c7e346b5aadd510a8d2c16fd6f6af26877c6b65d64d09bff2719325c8cd72491b10c0827c8ed15a76a25146a7664b45d0fd72303fa73ce10597948fff6c0338e5b484e916d96a34bff6de3106f4be31b1e1a44e6c3b6d1ed38476b55b0e95679ed53828e786cbe4b806a327ce12a7212ac724fefdbda7133af8e4029864f1fc43c2ebbaa7dc03cf15b4c0e3916459a96a7b5027bd4612d337f191de65745bff980460b79886cc8e5cd8b0b17855191d1e0d78be7a545488e6d34b2d9c30c34c44d86282db5f5c1b13b8da51bf72c85843487d57f793682c0ffeb8723c5facc966121a4c471bc29e50e5c691540996d86bc55279559e9a787d174c054b6534adea9882932df8ab94ac3233a5374dedb16443d8f650841ab009f13a0f8116fb47db06f4c6da6bd38c29a01308275775f0750bdf757f8e6942673934a0887fdc50fe3c960f76660c25c7bb7d1ead13a672f6c8eb54e650833a1afcbdca0ed8f07e7b83d8d65f9ce214c671cd0ae5fcc91d996f145ff4029d460d6d4a96c0631e47d60f9a07c1cedc8ca2b7ec90ff45e7ffb85e00eecd79f3465ec1170f318fe10858be418d82620db3b2df43035c5a0a0011a1a83a7ab6a06e2a6da8dce601152aa46d91fe62d172948fda0fda61c7697f074f72c094521168fb80fb43d1c64d38ae7a04e4e2ebda52242c4a05dca0bcc0bda815be000e9c3f5c08993a82719253d19fc249fbe50b3a63374e16337af4b38ffe90cb4126ff49e9a06f6d7bd35697785fef45861dc0ebc59842512e2e2e78a8761d48203c6493cc2c91c59bf192a5a3f8c704f4fabdabc3cfc60ad58268789f2fdf0cc24025b9c577bed0ccac91d2f13b2445f2cb712c1cdc6c84b0ae0f87eae6e9af23594cd486699785d86845e43e69e180eed55d03f85eb3e1fd0ba8ff45483fc9aefebfd2143747dc0d028edda43d4717b827aea33d3d022df3ffc192e9fd0cbdb8ef70e1483984ae11f1c198e559ca8fb146ab5874dd9576ef8d223fe1c95c8fac19e4bd9d63ec984f53c3ad41f2fa2a9ca821372dcc749ca82b6fb7a40e91b23b05cf1253c5fabf8a28a054c52e5fae34dc8ce9181cca019fab9eb0615a4e3cae507de20dae64da46f6c7499be2716c1a9d421302c3f21ee0342b99eff5b7e6d8fe49d0ea7e1a8eb0cae7848ab2b25463f2cab57982bde5cf22da0e7b06622c939f732ab30fc501600a20430121b2fcf57de4c1fbf91ce62eba5df626ca2174ca0d7b7b2d56dbedabbbf5da8eefbdb41af6e56684a961ceed4e58bae00ddf511f4817c43d3d0f3c61c95ca73bdb47a63fbb24879d8155e4ffa38585969f922d783b61b9affaf700f6e46e4d16c2d35c4a9af4476305347a9adb0f5af7f9a9ce925e9ca8c5bf6465da0dd4f84f7bc12e5e789697657a04dbee27537bfb42e1b7a49fee800844cba62c9923c875f58c242448c971e1a6d957198428b1f66d58da64d54ab756c0e9a002a4c6331df348a10e10e4fdcc1d88c6a1b075de891eb315be3c063d940e07d3e53d7cda13f4eaaad2b3507dfd3483e73f7d9ba52c9060c252f02216be12cd40676186bb9e3d406e119ed9d6620125f87c54cda03191ed0423f4b7de725b6698c98551d656161fb7929af931036fb80a0bca249e509c37ddf07f8ab183166efdc07fe40cb3b712d45bcce3db840337d4ceca41fbc71ae819f65574e9ff4c622291818676b0cad584e8e9678e960c7fb7bef66c59240061f6b5977f8aa10a9b0cd2e0bf4db4e98a8893ff52950779a1516182fd1a307f45701d1e5abacead5601ee7cf4f7b9326a99ef43432bbd0a6"}, 0x100a, 0x2) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) 01:47:46 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x1f00, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 366.071566] binder: 13622:13623 ioctl 40046207 0 returned -16 [ 366.108703] binder_alloc: 13622: binder_alloc_buf, no vma [ 366.114336] binder: 13622:13633 transaction failed 29189/-3, size 0-0 line 3035 [ 366.149264] binder: send failed reply for transaction 245 to 13622:13623 [ 366.183927] binder: undelivered TRANSACTION_COMPLETE 01:47:46 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) 01:47:46 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) 01:47:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x500, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 366.356841] binder_alloc: binder_alloc_mmap_handler: 13647 20001000-20004000 already mapped failed -16 01:47:46 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) fcntl$notify(r1, 0x402, 0x24) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 366.407249] binder: BINDER_SET_CONTEXT_MGR already set 01:47:46 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x3f00, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 366.460473] binder: 13647:13650 ioctl 40046207 0 returned -16 [ 366.501189] binder_alloc: 13647: binder_alloc_buf, no vma 01:47:46 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) [ 366.544758] binder: 13647:13658 transaction failed 29189/-3, size 0-0 line 3035 01:47:46 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) [ 366.589953] binder: send failed reply for transaction 248 to 13647:13650 [ 366.641152] binder: undelivered TRANSACTION_COMPLETE 01:47:46 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x4700, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:46 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) getsockopt$inet_dccp_buf(r0, 0x21, 0x0, &(0x7f00000001c0)=""/254, &(0x7f0000000000)=0xfe) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x280, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f0000000080)=0x1) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='*\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="715a091c5b433f7e41e0fdfc250d38c3aa8e0bff94a2378145cebf611e805dc79eebe8f80e784c6d0000f439e5992b2fdf7917617caa2747a46cce52f41cc0dfcf8a5ec6be3bf2dfe78d4f35eaf5fb658262507b59f8f78bda8f37ee95112f09bc0bb250444310c3e209a7e6f0325d3a673cef7a6e0700000000000000d8a17dd87eb2760e30c3290ecef87bd40e23f9f92545484e571ea1b63a4d0fb48d1c47cedaafdf42412d9785b3bab9f4b943aa1590ab33addffbc6f69d0abb39fc206b6132ace3a38f58825774b5fd2d5510ce316b4100000000000000000000000000"], 0x1}}, 0x5000000) 01:47:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x600, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:47 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x6000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 366.899324] binder: BINDER_SET_CONTEXT_MGR already set 01:47:47 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) 01:47:47 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) sendto$packet(r2, &(0x7f0000000100)="0d2edb989ed70987baf2daff897c8cf36ad89bb4677a3b8a91c4c32d6555be64a259a6e53588aee25ef05bad5c7e28b3ce38aa1b596ab96ebadb4636a47b4796a97f8edcc595171ba9e50fc5104fdb8b17c077e6", 0x54, 0x20000000, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="449bf3336b6b8cfac066a691843052de660987b4fc1d5539bf2c1e317017163afa7561c9c5393f5454da559a8014180ecac9f4ee4fa8e3bd23fc9a9cc4994fc264eb5edc35099d23a8b9567f49d8bf5e58843319770bfb4ec785c810a930010000000000000089666c487379309eb74ed6cb9f143dd922bdaa03b8544ae5723d74bdaa3566cc048bc4cef92ff966bca50107d5f53429f94854f929da7b1ecb3d06595eb0e924e237ecb52a07d204ac3a4c42c6da36"], 0x1}}, 0x5000000) [ 366.967070] binder: 13678:13680 ioctl 40046207 0 returned -16 [ 366.967098] binder_alloc: 13678: binder_alloc_buf, no vma 01:47:47 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) 01:47:47 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) 01:47:47 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 367.066753] binder: release 13678:13679 transaction 251 out, still active [ 367.079613] binder: 13678:13685 transaction failed 29189/-3, size 0-0 line 3035 [ 367.083394] binder: undelivered TRANSACTION_COMPLETE 01:47:47 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000080)=0x800000001, 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 367.159519] binder: send failed reply for transaction 251, target dead 01:47:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x700, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:47 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x40000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 367.381455] binder_alloc_mmap_handler: 1 callbacks suppressed [ 367.381475] binder_alloc: binder_alloc_mmap_handler: 13710 20001000-20004000 already mapped failed -16 [ 367.426304] binder: BINDER_SET_CONTEXT_MGR already set 01:47:47 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0xe0000, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x20, 0x4) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:47 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf0ffff, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:47 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) 01:47:47 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) 01:47:47 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) 01:47:47 executing program 0: r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x0, 0x400) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000300)={0x34, 0x0, &(0x7f00000002c0)}) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f00000001c0)={'security\x00', 0xa6, "3fabfd78b5bbb1a06f2111e91873f44036ef91b9585fc62ad10d1c514e9b1df7f211bb63127bf8d4f8333c6b0813a37ef7c04e18f493c2edf226b14b733337581defd21f5c8de78f785c0488d73a83dd703701cd5eb48227b2e15fed081353978e0c8217bccb769f56d35828f0e9fbefffee44e53294abf355cbc2805ae549d67891a6df3235fc0ba151222458a5ec555c3d43796c58fa5430b026463733ab37ad1e470ecc2c"}, &(0x7f0000000080)=0xca) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{}]}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) close(r1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 367.680948] binder: 13710:13711 ioctl 40046207 0 returned -16 01:47:47 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x1000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 367.728983] binder: send failed reply for transaction 254 to 13710:13711 [ 367.791066] binder: undelivered TRANSACTION_COMPLETE 01:47:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xa00, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:48 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x2000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 368.014327] binder_alloc: binder_alloc_mmap_handler: 13745 20001000-20004000 already mapped failed -16 01:47:48 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="33a47ce00abb5e6a27e97eaaf25d75595c316669614aba088d738a49ff546290f87978b10fcb191bf776629eb988341f49392437a70e88a833a8f191f5a3a0ac82373c2388e770349a4d209978d59d09bdd5826735582c94ccc6c2f6826ee3288dac5e9f105853c5b95566290df9757c262b326e0dcabf59c043e59b11b227727db4b4ff7dfa2e3566a0e1e92b81b613ca997fadd30e24bd030ff87f4a929231b04f6d4978f79a1b6c679a"], 0x1}}, 0x5000000) 01:47:48 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) 01:47:48 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x3000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 368.078399] binder: BINDER_SET_CONTEXT_MGR already set 01:47:48 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) [ 368.138761] binder: 13745:13746 ioctl 40046207 0 returned -16 [ 368.144844] binder_alloc: 13745: binder_alloc_buf, no vma 01:47:48 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) [ 368.189518] binder: send failed reply for transaction 256 to 13745:13746 [ 368.206703] binder: 13745:13748 transaction failed 29189/-3, size 0-0 line 3035 01:47:48 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x1200, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:48 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x4000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 368.499057] binder_alloc: binder_alloc_mmap_handler: 13776 20001000-20004000 already mapped failed -16 01:47:48 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x200000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000000100)) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) [ 368.574664] binder: BINDER_SET_CONTEXT_MGR already set 01:47:48 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) 01:47:48 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x5000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 368.600906] binder: 13776:13777 ioctl 40046207 0 returned -16 01:47:48 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:48 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) [ 368.643010] binder_alloc: 13776: binder_alloc_buf, no vma [ 368.678897] binder: 13776:13782 transaction failed 29189/-3, size 0-0 line 3035 01:47:48 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2743d0b3afec5c5ab06f7117ac8e8be5659b88bf90dcf09202be128e51d95e326e2ca3d204d715accb3035a2680ae5a9e163871c3e8901ea5730db6f5d5ae2f2db0375fdef0a0d43277e67c30816b94106f34f8a6f2030d197d455b97c4394967466cba03e89864ab234b488cb56f26cd5d870ec978e1d8cb9f66a74b33715cbd822cc6452af25fa91553507554d435015ec8dab5b06d2c1ba2235b8caaa20bab3a31ac8c3628aaee62cd4c5c7608d125312fe5ef430bcac0000000000000000"], 0x1}}, 0x5000000) [ 368.728710] binder_release_work: 8 callbacks suppressed [ 368.728718] binder: undelivered TRANSACTION_ERROR: 29189 01:47:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x2000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 368.793190] binder: send failed reply for transaction 259 to 13776:13777 [ 368.832968] binder_release_work: 1 callbacks suppressed [ 368.832973] binder: undelivered TRANSACTION_COMPLETE 01:47:49 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x6000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 368.915424] binder_alloc: binder_alloc_mmap_handler: 13804 20001000-20004000 already mapped failed -16 [ 368.922787] binder: undelivered TRANSACTION_ERROR: 29189 [ 369.026223] binder: BINDER_SET_CONTEXT_MGR already set 01:47:49 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x7000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 369.077383] binder: 13804:13805 ioctl 40046207 0 returned -16 [ 369.117522] binder_alloc: 13804: binder_alloc_buf, no vma 01:47:49 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x6, 0x24c9c0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000080)={0x9, 0x20000000000000}) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="72efccfdf66504760c7bbbf48ce791e424e36b343d2ebb70b1a60f2bff2c455cf2776dd6134293c728715348e3fc146a00673006debddae26f2b60517c00bf9f30839e"], 0x1}}, 0x5000000) 01:47:49 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) 01:47:49 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:49 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) [ 369.159699] binder: 13804:13812 transaction failed 29189/-3, size 0-0 line 3035 [ 369.191182] binder: release 13804:13805 transaction 262 out, still active [ 369.198235] binder: undelivered TRANSACTION_COMPLETE 01:47:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x3f00, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 369.258419] binder: undelivered TRANSACTION_ERROR: 29189 [ 369.296976] binder: send failed reply for transaction 262, target dead 01:47:49 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) readlinkat(r2, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=""/202, 0xca) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x8980, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x0, &(0x7f0000000080)=0x10001, 0x4) 01:47:49 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 369.402530] binder_alloc: binder_alloc_mmap_handler: 13830 20001000-20004000 already mapped failed -16 01:47:49 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x8000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 369.447344] binder: BINDER_SET_CONTEXT_MGR already set [ 369.517304] binder: 13830:13831 ioctl 40046207 0 returned -16 01:47:49 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x9000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:49 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 369.595514] binder_alloc: 13830: binder_alloc_buf, no vma [ 369.629341] binder: 13830:13844 transaction failed 29189/-3, size 0-0 line 3035 01:47:49 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) 01:47:49 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x8, 0x2040) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f00000005c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0029b5", @ANYRES16=r3, @ANYBLOB="000826bd7000fedbdf2508000000500001002c000200080004006c080000080004008e00000008000400506b983d080002000700000008000200a20f0000100001007564703a73797a30000000000800030008000000080003007f00000014000600080001000000000008000100fa0000002400060004000200080001001f00000004000200080001000900000008000100817100003800060008000100ff03000008000100050000000400020008000100ff010000080001000600000008000100090000000800010001000000"], 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8800) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYPTR64=&(0x7f0000000100)=ANY=[@ANYRES16=r1, @ANYRESHEX=r1, @ANYRESHEX=r1, @ANYRESDEC=r0, @ANYRESDEC=r1, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRESHEX, @ANYRES64=0x0, @ANYBLOB="ed2f3e05df5d00eac758629d061da8ef975b5b003af34650a7c57212c514bf02e7a3d91c5f61f37b587dd8ba9a331714f48832f80775d31c8c7e43e2e9eec9898573f8c45b2f4a0a38cc7056ac744d260daff8d47676fb5516ce4f144b19be4c7f3005b06cc274810ae41eb222da4daed6b12f1047302cbffb70a2faffbaec1c8438d776c8e9a5caac49bbde91c3ab791b6d3a2574de3cf049b5a4d95bf88eb0e11a6172d591729e92b167831f06a6f55e9b4c611f", @ANYBLOB="3de52d0a880b3e528cf7d74c2292eaffb585174b0eeb9ae5d9f4018f11b726b6436debf73bbeedaeb6a449abcd10b68a7a9f2f3c063f6d37c8d00698a50d36ed93a403d17ea2c2540c1024b20c97bb440b86a62f41c501686fa0d359cda2bf8b99ae843763cd7e3502eb6e595f2e6403fc0d1f3926f74d4a0de478c4d2454c2f9a1a154e4d5b0019d3b4e2fe3fcf323359126aa1ab54496696da04e87bcdff08516a6af39b5bc5b3", @ANYRES32=r0], @ANYPTR=&(0x7f0000000040)=ANY=[@ANYRESDEC=r0]]], 0x1}, 0x1, 0x0, 0x0, 0x400400080b}, 0x14) 01:47:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4800, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 369.658948] binder: release 13830:13831 transaction 265 out, still active [ 369.670704] binder: undelivered TRANSACTION_COMPLETE [ 369.698363] binder: undelivered TRANSACTION_ERROR: 29189 01:47:50 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 369.766183] binder: send failed reply for transaction 265, target dead [ 369.847816] binder_alloc: binder_alloc_mmap_handler: 13858 20001000-20004000 already mapped failed -16 01:47:50 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xe000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 369.893299] binder: BINDER_SET_CONTEXT_MGR already set 01:47:50 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) flock(r1, 0x2) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 369.943551] binder: 13858:13859 ioctl 40046207 0 returned -16 01:47:50 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 370.040330] binder_alloc: 13858: binder_alloc_buf, no vma [ 370.045963] binder: 13858:13873 transaction failed 29189/-3, size 0-0 line 3035 01:47:50 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 370.086831] binder: send failed reply for transaction 268 to 13858:13859 [ 370.106075] binder: undelivered TRANSACTION_COMPLETE 01:47:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:50 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x0, 0x0) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080)={0x3, 0xffffffffffffff9c}) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) listen(r2, 0x11400000) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="98f7375696ea6b0ba6ecdd80bc173472cb4081877103e0070f0587b3230b75aa20b56ff524845d83dc2bf95b79d7692ead8705075174e5eb6b3e8f794d477d895cfaf09e5b7d050e5f9a83274a03e643dd60cc09d88b3b232d467be551dd979135fbc7e3bbc57ba8ffbc55e513a64c8fa985ea3458c90bea0e039aeeb8cb1850a2e3efae022f2bf5426365b595"], 0x1}}, 0x5000000) [ 370.143977] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.188186] binder: undelivered TRANSACTION_ERROR: 29189 01:47:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4c00, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:50 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) 01:47:50 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x13000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:50 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = dup2(r1, r1) ioctl$TCSBRKP(r2, 0x5425, 0xfffffffffffffff8) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:50 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 370.378006] binder_alloc: binder_alloc_mmap_handler: 13889 20001000-20004000 already mapped failed -16 01:47:50 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 370.489163] binder_alloc: 13889: binder_alloc_buf, no vma [ 370.489849] binder: BINDER_SET_CONTEXT_MGR already set [ 370.497537] binder: 13889:13895 transaction failed 29189/-3, size 0-0 line 3035 01:47:50 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x1f000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 370.548846] binder: 13889:13894 ioctl 40046207 0 returned -16 [ 370.568947] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.574471] binder: send failed reply for transaction 271 to 13889:13894 01:47:50 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x280, 0xe0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000080)) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3b0915bf990a00700997fb0c487523a76be2ff26f33aeb2db2bd27fb31177c185f730970347a81ace8b525ab2280492ed65db98a56dd208a13640a28163bdb2a1db27ea88ec9552429198f773f2be60e1c9ee78c5e76374af2b645e614c59a0f60e1a1f2c58c7be88631d5253db0950dd27cfb524ef7fce7c8e4dd3e415f95d768ce2b1fa083221555926a"], 0x1}}, 0x5000000) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x3, 0x1, &(0x7f0000000100)=""/116, &(0x7f00000001c0)=""/11, &(0x7f0000000200)=""/84, 0x6000}) [ 370.646547] binder: undelivered TRANSACTION_COMPLETE 01:47:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:50 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:50 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) 01:47:50 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x3f000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 370.710908] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.807350] binder_alloc: binder_alloc_mmap_handler: 13919 20001000-20004000 already mapped failed -16 01:47:51 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000080)={0x0, 0x31b, 0x0}, 0x4008005) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="aa18b19b40786f00eb9d23325f778c581ad1d5d92bae9f3db1f0480b3448d203929b74f3804bfcc746"], 0x1}}, 0x5000000) [ 370.911199] binder: BINDER_SET_CONTEXT_MGR already set [ 370.916528] binder: 13919:13922 ioctl 40046207 0 returned -16 01:47:51 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x47000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 370.973734] binder_alloc: 13919: binder_alloc_buf, no vma [ 371.006499] binder: 13919:13936 transaction failed 29189/-3, size 0-0 line 3035 [ 371.019976] binder: send failed reply for transaction 274 to 13919:13922 [ 371.027692] binder: undelivered TRANSACTION_COMPLETE 01:47:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) recvfrom$inet(r0, &(0x7f0000000340)=""/183, 0xb7, 0x20, &(0x7f0000000280)={0x2, 0x4e22, @broadcast}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000140)={0x0, 0x5, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYRES16=r0], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x5000000) userfaultfd(0x800) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x5, 0x6, 0x4, 0x10, 0x3, 0x2, 0xfff, {0x0, @in={{0x2, 0x4e21, @remote}}, 0x1, 0x2, 0x17e92513, 0x1000, 0xacc}}, &(0x7f0000000040)=0xb0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000080)={r2, 0x3}, &(0x7f0000000100)=0x8) 01:47:51 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 371.072439] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.107601] binder: undelivered TRANSACTION_ERROR: 29189 01:47:51 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6800, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:51 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x60000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:51 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) [ 371.281020] binder_alloc: binder_alloc_mmap_handler: 13951 20001000-20004000 already mapped failed -16 [ 371.299570] binder: BINDER_SET_CONTEXT_MGR already set 01:47:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="3995a25da1d7b7b0f7c1d3c91882ea2bae04fec1ff4e3ff45bfd3b8b39f77761181acb59bd8a73495cacdb66d6f3c10b6e1df83bfddcae55f78148b820ede1d76372cd58ba8eb6ecfae78d211c94ae6569998157088f804d"], 0x1}}, 0x5000000) ioctl(r1, 0x7, &(0x7f0000000100)="c32a47f24914590c76fc380e1e54ca27a7329dedaf0a8b956661504b83386628baea209200a28621589aa8145297a92baf34691c0f9dcc595ea96b9dad4115cfeb4c9a3de0db5b76bcfbd8b2c71168ec2652") [ 371.369392] binder: release 13951:13952 transaction 277 out, still active [ 371.376399] binder: undelivered TRANSACTION_COMPLETE [ 371.388655] binder: 13951:13952 ioctl 40046207 0 returned -16 01:47:51 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x8dffffff, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 371.430338] binder: send failed reply for transaction 277, target dead 01:47:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6c00, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x20000, 0x0) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000280)="a17a873980a996551b821ef9ef74ff9911eea389e55e9f3b73951021535a9886de877ed35d50dd5871bc0395d5c40dc11052dd39f540076611f62fd40d40f7") getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x0, 0x4, 0x7f, 0x8, 0x0, 0x6, 0xffce, {0x0, @in6={{0xa, 0x4e21, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, 0x9e, 0x29, 0x1000, 0x6, 0x7fff}}, &(0x7f0000000080)=0xb0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000100)={r3, 0x388}, &(0x7f0000000140)=0x8) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x4004010) 01:47:51 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:51 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:51 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf5ffffff, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 371.740765] binder_alloc: binder_alloc_mmap_handler: 13983 20001000-20004000 already mapped failed -16 01:47:52 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x20000, 0x0) ioctl$VIDIOC_G_INPUT(r2, 0x80045626, &(0x7f0000000080)) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100), 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:52 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) 01:47:52 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xfffff000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 371.809424] binder_alloc: 13983: binder_alloc_buf, no vma [ 371.822526] binder: 13983:13989 transaction failed 29189/-3, size 0-0 line 3035 [ 371.874059] binder: BINDER_SET_CONTEXT_MGR already set 01:47:52 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:52 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 371.978727] binder: 13983:13984 ioctl 40046207 0 returned -16 [ 371.978871] binder: send failed reply for transaction 279 to 13983:13984 [ 372.050850] binder: undelivered TRANSACTION_COMPLETE 01:47:52 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xffffff8d, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:52 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x8, 0x40000) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000100)=""/57) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='clear_refs\x00') ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7400, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:52 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xfffffff5, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 372.350123] binder: BINDER_SET_CONTEXT_MGR already set [ 372.369200] binder_alloc: 14012: binder_alloc_buf, no vma [ 372.375054] binder: 14012:14013 ioctl 40046207 0 returned -16 01:47:52 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:52 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:52 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x2, 0x8, 0x4, 0x6, 0x5}, 0x14) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 372.431427] binder: 14012:14016 transaction failed 29189/-3, size 0-0 line 3035 [ 372.463283] binder: send failed reply for transaction 282 to 14012:14013 [ 372.529475] binder: undelivered TRANSACTION_COMPLETE 01:47:52 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7a00, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:52 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x4000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:53 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000ac5000), 0x4) sendmmsg$unix(r0, &(0x7f00000bd000), 0x80, 0x0) r1 = memfd_create(&(0x7f0000000080)='dev ', 0x3) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r0, r1, &(0x7f0000000000), 0xffff) fcntl$addseals(r1, 0x409, 0xd) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8}) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1004000000016) r3 = socket$inet_tcp(0x2, 0x1, 0x0) close(r3) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 372.752081] binder_alloc_mmap_handler: 1 callbacks suppressed [ 372.752101] binder_alloc: binder_alloc_mmap_handler: 14038 20001000-20004000 already mapped failed -16 01:47:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:53 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf0ffffffffffff, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 372.868485] binder: BINDER_SET_CONTEXT_MGR already set 01:47:53 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 372.922905] binder: 14038:14039 ioctl 40046207 0 returned -16 [ 372.963783] binder_alloc: 14038: binder_alloc_buf, no vma [ 373.007039] binder: 14038:14052 transaction failed 29189/-3, size 0-0 line 3035 01:47:53 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:53 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 373.061741] binder: send failed reply for transaction 285 to 14038:14039 [ 373.086538] binder: undelivered TRANSACTION_COMPLETE 01:47:53 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x100000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x1000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:53 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:53 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x200000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 373.293803] binder_alloc: binder_alloc_mmap_handler: 14067 20001000-20004000 already mapped failed -16 [ 373.339250] binder: BINDER_SET_CONTEXT_MGR already set [ 373.367318] binder: 14067:14071 ioctl 40046207 0 returned -16 01:47:53 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 373.423460] binder_alloc: 14067: binder_alloc_buf, no vma 01:47:53 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x300000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 373.537587] binder: 14067:14072 transaction failed 29189/-3, size 0-0 line 3035 [ 373.587125] binder: send failed reply for transaction 288 to 14067:14071 01:47:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_GEM_CLOSE(r2, 0x40086409, &(0x7f0000000100)={r3}) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000680)=ANY=[@ANYBLOB="4108dca863eb410abd999f271d49158db07528d279f52427b69f5de5ebb912d9f7eecc0ac6d94806fed61caccada71fe9b99c462aed90d92434c20da00e7e16494537c9776b832be764bdce03ed3745fabc0c3aab02b4bb982cfab9ae22ce78c9e5fd989be1986b0221a82f9942d49dc50a3228580682383c901ad99b14ce81b30c14da167d94d53bf25ce8dc0f246dc6a9b86ae4348610a915049412427c0fc444538a5207fcb3b2b1c983afb50a52602dcdabfda6d624f177fb5e97bd735070fbfe66733c48ccfa5920e8187ad5fc9a3390330fb67b46629746a4f3c461e23ad8d1e8e72bf45dd3a290000000000000000000000009e4607e20ad0696339ee5a78825fead4b7ba096a96456799faa9b43f3df1811ed9e2e7ab5cf3c7197bfceb7c295e35918ebe9c542be7ca6b4d4028c42b91e736617cc4a9b30138b1448323e6c4bc2cb1f3dadc17f72030f35594f14d29d2f82653aa64b483852300cf935923731b66ca86e7f83e079e6213f7c89bbe8754d5ce79cffcc03677faa0ae57acad143fc6a42d48f3f76a46de"], 0x1}}, 0x5000000) 01:47:54 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x2000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:54 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x400000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:54 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:54 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 373.887372] binder_alloc: binder_alloc_mmap_handler: 14096 20001000-20004000 already mapped failed -16 01:47:54 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x500000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 373.958777] binder: BINDER_SET_CONTEXT_MGR already set [ 373.991130] binder: 14096:14099 ioctl 40046207 0 returned -16 [ 374.026160] binder_alloc: 14096: binder_alloc_buf, no vma 01:47:54 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x20000, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000080), &(0x7f0000000100)=0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) close(r1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5f7c80d3ddae62671265a810887a8f14fe379fbde55d61a173c1fc9f97b464e727f2b56507415ca60a81ee20ce387db7cc3497054032038d08ca771f3a4fcd75809a0363ca07b358c1cc4f010432df1960192b5c5bc61e296df7f548e32e20a0ae5359893816fc8cd1f49388fd247e425018c162"], 0x1}}, 0x5000000) [ 374.080499] binder: send failed reply for transaction 291 to 14096:14099 [ 374.116488] binder_release_work: 1 callbacks suppressed [ 374.116494] binder: undelivered TRANSACTION_COMPLETE 01:47:54 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:54 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x600000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 374.139884] binder: 14096:14110 transaction failed 29189/-3, size 0-0 line 3035 [ 374.146497] binder_release_work: 8 callbacks suppressed [ 374.146503] binder: undelivered TRANSACTION_ERROR: 29189 01:47:54 executing program 4: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 374.214925] binder: undelivered TRANSACTION_ERROR: 29189 01:47:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x4000, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080), &(0x7f0000000100)=0x14) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:54 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:54 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x700000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x3000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:54 executing program 4: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 374.570344] binder_alloc: binder_alloc_mmap_handler: 14136 20001000-20004000 already mapped failed -16 01:47:54 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x800000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:54 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x105000, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) write$capi20_data(r2, &(0x7f0000000100)={{0x10, 0x9, 0x1, 0x81, 0x7, 0x3ee0}, 0x63, "220076f4fe1c491166dc30717a395eeec7ee48d7cda311c869ee0e6faf08793ff66447a05da1bf29e6994ff8e84fb70a5da92805ae294d2f75614c87944c2a00ba5cfa5416f1c7843d2c420fdd4c7337da6f52ce825ffb72386adac699c0f491dbd0aa"}, 0x75) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prctl$PR_CAPBSET_DROP(0x18, 0x7) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[]}}, 0x5000000) creat(&(0x7f0000000040)='./file0\x00', 0x80) [ 374.618893] binder: BINDER_SET_CONTEXT_MGR already set [ 374.624235] binder: 14136:14137 ioctl 40046207 0 returned -16 01:47:54 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 374.689978] binder_alloc: 14136: binder_alloc_buf, no vma 01:47:55 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x900000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 374.777315] binder: 14136:14144 transaction failed 29189/-3, size 0-0 line 3035 01:47:55 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 374.842103] binder: undelivered TRANSACTION_ERROR: 29189 [ 374.847705] binder: send failed reply for transaction 294 to 14136:14137 [ 374.900640] binder: undelivered TRANSACTION_COMPLETE 01:47:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 374.935669] binder: undelivered TRANSACTION_ERROR: 29189 01:47:55 executing program 4: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:55 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xe00000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 375.072507] binder_alloc: 14163: binder_alloc_buf, no vma 01:47:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) readv(r0, &(0x7f0000000100)=[{&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/209, 0xd1}, {&(0x7f0000000040)=""/89, 0x59}, {&(0x7f00000013c0)=""/140, 0x8c}, {&(0x7f0000001480)=""/222, 0xde}], 0x5) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/btrfs-control\x00', 0x400100, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[]}}, 0x4fffffd) [ 375.138322] binder: 14163:14168 transaction failed 29189/-3, size 0-0 line 3035 01:47:55 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:55 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 375.192261] binder: undelivered TRANSACTION_ERROR: 29189 01:47:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x5000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:55 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf00000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 375.402536] binder_alloc: binder_alloc_mmap_handler: 14186 20001000-20004000 already mapped failed -16 01:47:55 executing program 4: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 375.447339] binder: BINDER_SET_CONTEXT_MGR already set [ 375.501172] binder: 14186:14188 ioctl 40046207 0 returned -16 [ 375.509135] binder: release 14186:14188 transaction 299 out, still active [ 375.516184] binder: undelivered TRANSACTION_COMPLETE [ 375.528898] binder_alloc: 14186: binder_alloc_buf, no vma [ 375.574888] binder: send failed reply for transaction 299, target dead [ 375.589071] binder: 14186:14192 transaction failed 29189/-3, size 0-0 line 3035 01:47:55 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x39, &(0x7f00000000c0)=0x1, 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = accept4(r0, &(0x7f00000002c0)=@xdp, &(0x7f0000000080)=0x80, 0xa93ee70757aad587) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x600000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x44, r3, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x556}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x200, 0x0) write$FUSE_INIT(r4, &(0x7f0000000100)={0x50, 0xfffffffffffffffe, 0x1, {0x7, 0x1c, 0xc, 0x404, 0x1, 0x1, 0x80}}, 0x50) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="e5bca03276a8bf009f748fe17f76342a317ee587dc27bc17cf2c8d9f1be6e59f1b756a597af50e71fca8d93a914c4107eac553a955f5f8c862c680a1e1aa7aca58f08623d0094e218f64773163176ab940fd51dae610728c2b669d3768dd6c6f3ff13a96129f4c0ab6feef8ac797ebdfbafee89578c61709bd4e902c9d9833dee97a5494d81c09fa0fc76463f1deb6b08f5d2effdfcf50e6cd41d9ff6904195560bec3243aa4ace7879f73e25608f65f13f5936e733708b79be0ad05c02e01910083583ff8e4cbb4ab2c01dafb91e319734b899993612785b32329986817d100"], 0x1}}, 0x5000000) 01:47:55 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x1300000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:55 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 375.699205] binder: undelivered TRANSACTION_ERROR: 29189 01:47:56 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e22, @local}, 0x10) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f6ab850ccbcc024c4de31d2944e87bfe9ade2c3bcb31837e82e1662fd8c5cc6eb95cf9bd8c569a94b89a856784b40b3bcf4ace28be69bea4db1970d0e811ff0065782737ffb2669aaaa1fe3f348c84be60f088d1e1bda345b8b1dae90a427fd80e1c2d777d0d2e5ba144a2d99e4bb5d9c183ce34bd84f32c0190d9328e6472007ea2051351"], 0x1}}, 0x5000000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000000080)=[0x2, 0x5]) 01:47:56 executing program 4: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:56 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x1f00000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 375.947140] binder_alloc: binder_alloc_mmap_handler: 14217 20001000-20004000 already mapped failed -16 [ 375.989303] binder: BINDER_SET_CONTEXT_MGR already set [ 376.038667] binder: 14217:14220 ioctl 40046207 0 returned -16 01:47:56 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x3f00000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 376.098720] binder_alloc: 14217: binder_alloc_buf, no vma [ 376.178636] binder: 14217:14227 transaction failed 29189/-3, size 0-0 line 3035 [ 376.196690] binder: send failed reply for transaction 302 to 14217:14220 01:47:56 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:56 executing program 5: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:56 executing program 4: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:56 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x4700000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 376.237525] binder: undelivered TRANSACTION_ERROR: 29189 [ 376.264471] binder: undelivered TRANSACTION_COMPLETE 01:47:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x222040, 0x0) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000080)=0x5, 0x4) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 376.304146] binder: undelivered TRANSACTION_ERROR: 29189 [ 376.349402] binder_alloc: binder_alloc_mmap_handler: 14242 20001000-20004000 already mapped failed -16 [ 376.459383] binder: BINDER_SET_CONTEXT_MGR already set [ 376.459401] binder_alloc: 14242: binder_alloc_buf, no vma 01:47:56 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f67b0142c816813eab0593cb4faa28d5482be57bcbdb2e2f1536ed720e15515b0e6318ef1184e829419404b0ec6953c7858f9316f58a545db19943254d4c224299483ac2bf18d0e7b3b823f164376e2537d9c10128d031c644f27a41be5ab46815b48f930e43b2f47314eba5b61502b302854b8aff0b885f846689c3420a16106e38c803d43093565e1e2b4289bff1a80e951dffca3344d86f41f7d1d66fd4194d0e9fc95ec08f546850892b28ad455d86cb5a415823b8ae83caae21087b94fa8ed988b66905fe80751395f94c3371d76be5"], 0x1}}, 0x5000000) 01:47:56 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 376.504921] binder: 14242:14247 transaction failed 29189/-3, size 0-0 line 3035 01:47:56 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x6000000000000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 376.564231] binder: 14242:14244 ioctl 40046207 0 returned -16 [ 376.579534] binder: send failed reply for transaction 305 to 14242:14244 01:47:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xa000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:56 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:56 executing program 5: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 376.635163] binder: undelivered TRANSACTION_ERROR: 29189 [ 376.668824] binder: undelivered TRANSACTION_COMPLETE [ 376.694810] binder: undelivered TRANSACTION_ERROR: 29189 01:47:57 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x8dffffff00000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e24, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 376.786874] binder_alloc: binder_alloc_mmap_handler: 14268 20001000-20004000 already mapped failed -16 [ 376.835231] binder: BINDER_SET_CONTEXT_MGR already set [ 376.929814] binder: 14268:14274 ioctl 40046207 0 returned -16 [ 376.930055] binder_alloc: 14268: binder_alloc_buf, no vma 01:47:57 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xf5ffffff00000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x1, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x84, r2, 0x105, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xff}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x24, 0x30}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x6, 0x10}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x12}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x20040090}, 0x40000) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f00000002c0)={'filter\x00'}, &(0x7f00000003c0)=0x78) 01:47:57 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 377.012634] binder: 14268:14284 transaction failed 29189/-3, size 0-0 line 3035 [ 377.020474] binder: send failed reply for transaction 308 to 14268:14274 01:47:57 executing program 5: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:57 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 377.080419] binder: undelivered TRANSACTION_COMPLETE 01:47:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x12000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 377.229894] binder_alloc: binder_alloc_mmap_handler: 14304 20001000-20004000 already mapped failed -16 01:47:57 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xffffffff00000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x74, r2, 0x422, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x50, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x10}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x8}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8b}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x28000000000000}]}, 0x74}, 0x1, 0x0, 0x0, 0x800}, 0x40) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x800, 0x80) sendmsg$IPVS_CMD_SET_SERVICE(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x112000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x40, r2, 0x205, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x20d5}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2b}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3f}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x8000) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 377.276946] binder: BINDER_SET_CONTEXT_MGR already set [ 377.282518] binder: 14304:14305 ioctl 40046207 0 returned -16 [ 377.296026] binder_alloc: 14304: binder_alloc_buf, no vma 01:47:57 executing program 5: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 377.398799] binder: release 14304:14305 transaction 311 out, still active [ 377.405823] binder: undelivered TRANSACTION_COMPLETE 01:47:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x20000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 377.444997] binder: send failed reply for transaction 311, target dead 01:47:57 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xfffffffffffff000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:57 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:57 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="766f927c007181646988efa5"], 0x1}}, 0x5000000) 01:47:57 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0xffffffffffffffff, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 377.643599] binder_alloc: binder_alloc_mmap_handler: 14324 20001000-20004000 already mapped failed -16 01:47:57 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:58 executing program 5: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 377.721601] binder: BINDER_SET_CONTEXT_MGR already set [ 377.737539] binder: 14324:14326 ioctl 40046207 0 returned -16 [ 377.757240] binder_alloc: 14324: binder_alloc_buf, no vma [ 377.787994] binder_transaction: 1 callbacks suppressed [ 377.788012] binder: 14324:14335 transaction failed 29189/-3, size 0-0 line 3035 01:47:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) statfs(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)=""/127) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="377e77492a4e048cee46b7ec0aa7093cb41cec2c4a7cf20dfeb3e2b89dac98dca81230def1f0a7d19ee1b75a37581e5947500fa9d39145da4efd55e6c4dd4c497443bd50b3319ef9f87354901ebcc0d5b83375a10df4b1d6c1d8bbfebbf1eb1ad9ca02cddd0deaf50c59da7e7892ca72ae2df99344c35007965463b554cf05961108ebd8582f57ad29f495510f163889d90ee567489eee7e8996743e0bac897b1e1bb84658309fde4a799bd668c07b84879910f081c2912cbb7a6b90872b2b1a1e7e4d4e08e5ed7ed396bbc9ea640781de36"], 0x1}}, 0x5000000) r2 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x2, 0x351001) accept4$packet(r1, &(0x7f0000001680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000016c0)=0x14, 0x80800) sendmsg$can_bcm(r2, &(0x7f0000001800)={&(0x7f0000001700)={0x1d, r3}, 0x10, &(0x7f00000017c0)={&(0x7f0000001740)={0x4, 0x650, 0x1000, {}, {}, {0x4, 0x3f, 0x2}, 0x1, @can={{0x3, 0x2, 0x6, 0x80000001}, 0x0, 0x1, 0x0, 0x0, "b0ced79c11da0c08"}}, 0x48}}, 0x0) 01:47:58 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x2, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 377.852095] binder: release 14324:14326 transaction 314 out, still active [ 377.881814] binder: undelivered TRANSACTION_COMPLETE 01:47:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x3f000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 377.933454] binder: send failed reply for transaction 314, target dead 01:47:58 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x3, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:58 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 378.103163] binder_alloc: binder_alloc_mmap_handler: 14349 20001000-20004000 already mapped failed -16 01:47:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000080)=r2) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:47:58 executing program 5: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 378.175717] binder: BINDER_SET_CONTEXT_MGR already set 01:47:58 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:58 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x4, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 378.238837] binder: 14349:14351 ioctl 40046207 0 returned -16 [ 378.315185] binder: 14349:14371 transaction failed 29189/-3, size 0-0 line 3035 [ 378.345164] binder: send failed reply for transaction 317 to 14349:14351 01:47:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="2b4a2d920995f8491c143ca90400333a4950296e715286a79a2f4d42ea0ce827000002000000060000000000"], 0x1}}, 0x5000000) [ 378.377217] binder: undelivered TRANSACTION_COMPLETE 01:47:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x48000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:58 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x5, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:58 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:58 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x8, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:58 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 378.561942] binder_alloc: binder_alloc_mmap_handler: 14385 20001000-20004000 already mapped failed -16 [ 378.595677] binder: BINDER_SET_CONTEXT_MGR already set 01:47:58 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x1, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f00000003c0)={r1, 0x916, 0x7ff, "06f76e86e6c6d3917d8fa60a286d7eda5bf585abe8bbbead7f16531666944ea7d4ed4e0a8b461137679415da93e9aa77d4398ce386659fce157812120672e41e12602ceef6857b8b41a8f3b1332ecf4bfa0f1f83d8b7875c2fe0a23884a996c3b379b09d981e3b6f47ae91925424ab6c5da35341583b02089fb80e48ec252bedc495445215e5d56997c497d259bd23b476976a1d21da5af8e85ce8a59dc57ff35a2354a18ceafae0d7846231ffe122c7571edec49675d950c3f4fc20cd8e90b221daf877fbcbcd3b2add132d552609cb0f305fa48ff195bc75dcd8d1f710b94f3a5cfe9d8a294926391e4492eb4f365e7423f83bbd69408ec1b3f6af4696a7b7406bd50f9fccab4661e660d81e48e8db74d82fe25691af372266ca08eb89ca8d90771b49fdb237115d02d7ce5e8aa1127d9e8122a7feea816cda4702bfb110b9866546a0e2f6a9adfa6ed8f521ba8c422425ff264f186941e6b95a78587a7154269408b1b2a66c19670eb44b377e3ffe616c6f"}) close(r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x2802, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x20000, 0x0) [ 378.624625] binder: 14385:14386 ioctl 40046207 0 returned -16 01:47:58 executing program 1: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:58 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x9, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:59 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 378.775962] binder: send failed reply for transaction 320 to 14385:14386 [ 378.795861] binder: undelivered TRANSACTION_COMPLETE 01:47:59 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=ANY=[@ANYBLOB="3dc77517840d51711a6a7c13c2df09cd8a0500a31ad5887f4bf1997dc7d4e607320fb82c5d7da1cc7d25937219f2640d94ddf568f2c7ee96d3d7326d257071554efcc03122a552ae33a8290ccaeae66d34fe58b78a8fb187948c1cfce299c83d873a3c343c1d80078804ad5a284661325ede8acb07e400342f78bc9e311e3181c80fedba9c2177c411083119221bafc3618313f6ca"], 0x1}}, 0x5000000) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) getresgid(&(0x7f0000000100)=0x0, &(0x7f0000000140), &(0x7f00000001c0)) getgroups(0x2, &(0x7f0000000200)=[0x0, 0xee00]) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getgid() ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000580)=@get={0x1, &(0x7f0000000540)=""/12, 0x1}) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000500)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0xb) getresgid(&(0x7f0000000300), &(0x7f0000000440)=0x0, &(0x7f0000000480)) setgroups(0x7, &(0x7f00000004c0)=[r2, r3, r4, r5, r6, r7, r9]) 01:47:59 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0xa, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4c000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:59 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:59 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 379.032477] binder_alloc: binder_alloc_mmap_handler: 14412 20001000-20004000 already mapped failed -16 01:47:59 executing program 1: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 379.090643] binder: BINDER_SET_CONTEXT_MGR already set 01:47:59 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0xb, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:59 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) r2 = syz_open_dev$mouse(&(0x7f00000006c0)='/dev/input/mouse#\x00', 0x401, 0x80000) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000700)=@req={0x2, 0x1, 0x6, 0x9}, 0x10) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r3 = getuid() getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000001c0)={{{@in, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000080)=0xe8) r5 = getuid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000c40)=0xe8) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}}}, &(0x7f00000005c0)=0xe8) r9 = openat$null(0xffffffffffffff9c, &(0x7f0000000c00)='/dev/null\x00', 0x0, 0x0) ioctl$NBD_SET_TIMEOUT(r9, 0xab09, 0x1) r10 = geteuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000b40)={0x0, 0x0}, &(0x7f0000000640)=0xfffffffffffffff4) getresgid(&(0x7f0000000680)=0x0, &(0x7f0000000c80), &(0x7f0000000100)) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000600)={r11, r12, r13}, 0xc) getpeername(r1, &(0x7f0000000b80)=@un=@abs, &(0x7f0000000b00)=0x80) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000ac0)=0x3) getresgid(&(0x7f0000000940)=0x0, &(0x7f0000000980), &(0x7f00000009c0)) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000a00)={{}, {0x1, 0x5}, [{0x2, 0x3, r3}, {0x2, 0x1, r4}, {0x2, 0x4, r5}, {0x2, 0x1, r6}, {0x2, 0x2, r7}, {0x2, 0x3, r8}, {0x2, 0x1, r10}, {0x2, 0x2, r12}], {0x4, 0x4}, [{0x8, 0x1, r13}, {0x8, 0x1, r14}, {0x8, 0x2, r15}, {0x8, 0x2, r16}, {0x8, 0x4, r17}], {0x10, 0x1}, {0x20, 0x4}}, 0x8c, 0x0) [ 379.155686] binder: 14412:14415 ioctl 40046207 0 returned -16 [ 379.156532] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 379.156540] binder_alloc: 14412: binder_alloc_buf, no vma 01:47:59 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0xe, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 379.256006] binder: release 14412:14415 transaction 322 out, still active [ 379.263648] binder: undelivered TRANSACTION_COMPLETE [ 379.306716] binder: send failed reply for transaction 322, target dead [ 379.343104] binder: 14412:14429 transaction failed 29189/-3, size 0-0 line 3035 01:47:59 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:59 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:59 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000080)=0x7) close(r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000040)={0x0, 0x10d, 0x0}, 0x24008004) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm-monitor\x00', 0x10000, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r3, 0x29, 0x2d, &(0x7f00000001c0)={0x1f, {{0xa, 0x4e21, 0x6f81332c, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7}}}, 0x88) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f00000006c0)={0x6, {{0xa, 0x4e24, 0x100000001, @mcast1, 0x9}}, {{0xa, 0x4e24, 0x2, @local, 0x8}}}, 0x108) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ea1f2a984bed1c1849bfcae787df2aea6853f8d46c62749d9026ec607c8645e6915df9b2cb425051f5386984c0b1f55b562749376523f1534bc98986b03e1012dafc1503a235450482a151a24807513b46554e459e3a182f088825bc8478451dd5067e276fa4fdd5b4789a09a691233dd94bdefcb10c7bd4d0733f39907073416cc612718c1b46850f5b734c556db29772516002c75571cd087c4dedf8ff9bc000f66f31869c8222379878ab33ce7e47fc5fbde98f3ed661293e01dfcb5c23f337a7a4b84696fc2cc8342cfaaffcf78433aa99de47"], 0x1}}, 0x5000000) ioperm(0x6, 0x49, 0x7) [ 379.393762] binder_release_work: 7 callbacks suppressed [ 379.393769] binder: undelivered TRANSACTION_ERROR: 29189 01:47:59 executing program 1: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:47:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x60000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:47:59 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0xf, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 379.615472] binder_alloc: binder_alloc_mmap_handler: 14452 20001000-20004000 already mapped failed -16 01:47:59 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x10, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:47:59 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x13) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) fcntl$setpipe(r1, 0x407, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 379.664171] binder: BINDER_SET_CONTEXT_MGR already set 01:47:59 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 379.708648] binder: 14452:14458 ioctl 40046207 0 returned -16 [ 379.755826] binder_alloc: 14452: binder_alloc_buf, no vma 01:48:00 executing program 1: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 379.812534] binder: send failed reply for transaction 325 to 14452:14458 [ 379.817162] binder: 14452:14469 transaction failed 29189/-3, size 0-0 line 3035 [ 379.851605] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.857100] binder: undelivered TRANSACTION_COMPLETE 01:48:00 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x14, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x68000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 379.857113] binder: undelivered TRANSACTION_ERROR: 29189 01:48:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000040), 0x4) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:48:00 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:00 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:00 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x46, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 380.035489] binder_alloc: binder_alloc_mmap_handler: 14481 20001000-20004000 already mapped failed -16 [ 380.092481] binder: BINDER_SET_CONTEXT_MGR already set [ 380.115469] binder: 14481:14484 ioctl 40046207 0 returned -16 01:48:00 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:00 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x47, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 380.176121] binder_alloc: 14481: binder_alloc_buf, no vma [ 380.198743] binder: 14481:14495 transaction failed 29189/-3, size 0-0 line 3035 01:48:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) accept4$unix(r1, &(0x7f0000000040), &(0x7f0000000100)=0x6e, 0x80000) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 380.222485] binder: release 14481:14484 transaction 328 out, still active 01:48:00 executing program 1: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:00 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 380.248888] binder: undelivered TRANSACTION_COMPLETE 01:48:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6c000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 380.329286] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.358163] binder: send failed reply for transaction 328, target dead 01:48:00 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x67, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r1}) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r2, 0x12, 0x2, &(0x7f00000001c0)=""/183, &(0x7f0000000080)=0xb7) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 380.444537] binder_alloc: binder_alloc_mmap_handler: 14513 20001000-20004000 already mapped failed -16 01:48:00 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:00 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 380.506044] binder: BINDER_SET_CONTEXT_MGR already set [ 380.566821] binder: 14513:14515 ioctl 40046207 0 returned -16 [ 380.598688] binder_alloc: 14513: binder_alloc_buf, no vma 01:48:00 executing program 1: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:00 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:48:00 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x3, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 380.622170] binder: 14513:14527 transaction failed 29189/-3, size 0-0 line 3035 [ 380.685699] binder: release 14513:14515 transaction 331 out, still active [ 380.708320] binder: undelivered TRANSACTION_COMPLETE [ 380.734043] binder: undelivered TRANSACTION_ERROR: 29189 01:48:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x74000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:01 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 380.759519] binder: send failed reply for transaction 331, target dead 01:48:01 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0xb, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) getsockopt$inet_tcp_buf(r0, 0x6, 0xf, &(0x7f0000000100)=""/111, &(0x7f00000001c0)=0x6f) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="b55d35eceb95d79ce739de4576f5aba539bc165454e8fc707130f06d3745093181f8eaed4347af16e1d87d73c957c2160771cdd0ba28e871789a9cbcc89a3ada50ef94fc94156fa6"], 0x1}}, 0x5000000) 01:48:01 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 380.853313] binder_alloc: binder_alloc_mmap_handler: 14542 20001000-20004000 already mapped failed -16 01:48:01 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x10, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 380.952146] binder: BINDER_SET_CONTEXT_MGR already set 01:48:01 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 380.989782] binder: 14542:14543 ioctl 40046207 0 returned -16 01:48:01 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 381.053437] binder_alloc: 14542: binder_alloc_buf, no vma 01:48:01 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x4, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 381.099168] binder: send failed reply for transaction 334 to 14542:14543 [ 381.112127] binder: undelivered TRANSACTION_COMPLETE 01:48:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x101000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000140)=r2) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) r3 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x4cf5, 0x4000) ioctl$EVIOCSABS3F(r3, 0x401845ff, &(0x7f0000000080)={0x6, 0x81, 0x5609, 0x0, 0x4000003, 0x80000001}) socket(0xa, 0x7, 0x2) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="399f6d73f984567c6bd519af11de0c5f6c0928e7e8adcbc5304e5d344ab65282dccd9ec5f9d9f9c5fbe7cd8d3dffff0000000000000000007500000483946fefc42afbd2045bd37b4c0816e171135b9ca638cbc177d211cc940cc1a374d811cbb7b08eface5748f59f35665d7b2462f2c9c512eef2832aef80f5ed72261b165ddeeee5efc0b7d98d52b93f6414854150c83ce5ac5786a66c5ef81212d6fc4435347beda6a5833efcd19f001393cff09791a20ff55e28a6236b06e5f7af3e65fd1c01d45e3c37460c6f8ee179907706f2d88ba6df2385ccf8fdf6605d27e7dd390fc48e02a763733102b5e4e6a0f5f4c2f6969efa5e947fd8fcd64d6de271f3e08925368fe3d429095fc8615d61398a5cb29fe595f6b9e1ab2e7c7beee0593dd542714cc69e6b3a28f14199d32647a4e340c353fc1e8bee6a56c60ea557b2a183bcf35d66ec696d0ee7a165be1124a5fe1b50596103500bfeedab099173db00000000f187c06344c8b6e5ac9d5ddf87768e6c929a38d22001eed8606963c574c08a0e9ca459bfb235cfae2ac240d682682020e047afe7a70e6a11b3dc8e46bcff9829a98d5286cc74c45782b79211ca17aaef557be1ff39d9493599e17415543af558c425a8552cc4f5e0f1b417b12ab279cee871ae0d02f2080a30ccd5b2c031cdd84663ec2a9a0b4ffbb28f02af4a360b38c8"], 0x1}}, 0x5000000) [ 381.141150] binder: 14542:14564 transaction failed 29189/-3, size 0-0 line 3035 [ 381.147803] binder: undelivered TRANSACTION_ERROR: 29189 01:48:01 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:01 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x6, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 381.323505] binder: undelivered TRANSACTION_ERROR: 29189 01:48:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7a000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:01 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:01 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:01 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:01 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x11, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:01 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x0, 0x0) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000100)={0x8, "81d7c50b3453321e1b58eba2be82f973a377d35651665787b649b7a35ca9cfc2", 0x4, 0x56606f74848b4592, 0xffffffff, 0x200, 0x10, 0x3, 0x1, 0x7}) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) epoll_create1(0x80000) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f1fbe3406ad09a1b2e630906603039cda046af9f4fc0aafdb76cf166fe2692359221d8521654cfdd8198e3f07779ff9de72296d4d67df42b8d4730dbfa34becd3c94af6e88d4befeb619bc819fb189a468120000b8fb3f8d50d6380cb33dd23f1459"], 0x1}}, 0x5000000) [ 381.491987] binder_alloc: binder_alloc_mmap_handler: 14593 20001000-20004000 already mapped failed -16 [ 381.592860] binder: BINDER_SET_CONTEXT_MGR already set 01:48:01 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 381.639192] binder: 14593:14594 ioctl 40046207 0 returned -16 [ 381.677712] binder_alloc: 14593: binder_alloc_buf, no vma 01:48:01 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:01 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x21, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:01 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 381.702300] binder: 14593:14606 transaction failed 29189/-3, size 0-0 line 3035 [ 381.722496] binder: release 14593:14594 transaction 337 out, still active [ 381.734052] binder: undelivered TRANSACTION_COMPLETE 01:48:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000400)) close(r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) syz_open_dev$vivid(&(0x7f0000000500)='/dev/video#\x00', 0x2, 0x2) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000480)={0x0, {0x2, 0x4e20, @local}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}, {0x2, 0x4e21, @loopback}, 0x102, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000440)='syz_tun\x00', 0x3, 0x2afe7051, 0xc6}) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r3, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x108, r4, 0x900, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x44, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xac1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x100000001}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1c0000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_LINK={0xb0, 0x4, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc32}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3668}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x80}, 0x8000) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 381.767467] dccp_invalid_packet: P.Data Offset(0) too small [ 381.779027] binder: undelivered TRANSACTION_ERROR: 29189 [ 381.795146] binder: send failed reply for transaction 337, target dead 01:48:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xfdfdffff, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 381.848635] dccp_invalid_packet: P.Data Offset(0) too small [ 381.908200] binder_alloc: binder_alloc_mmap_handler: 14623 20001000-20004000 already mapped failed -16 01:48:02 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:02 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x29, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:02 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) ioctl$FICLONE(r0, 0x40049409, r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 382.028815] binder: BINDER_SET_CONTEXT_MGR already set [ 382.034152] binder: 14623:14624 ioctl 40046207 0 returned -16 [ 382.081587] binder_alloc: 14623: binder_alloc_buf, no vma [ 382.087299] binder: 14623:14635 transaction failed 29189/-3, size 0-0 line 3035 01:48:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xfffffdfd, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:02 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x2b, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 382.172471] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.178022] binder: send failed reply for transaction 340 to 14623:14624 [ 382.220434] binder: undelivered TRANSACTION_COMPLETE 01:48:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = dup3(r1, r1, 0x80000) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={r3}, &(0x7f0000000140)=0x8) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3349d5da28f052d27d13daf5"], 0x1}}, 0x5000000) [ 382.245393] binder: undelivered TRANSACTION_ERROR: 29189 01:48:02 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 382.302937] binder_alloc: binder_alloc_mmap_handler: 14646 20001000-20004000 already mapped failed -16 01:48:02 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:02 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x2c, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 382.411584] binder: BINDER_SET_CONTEXT_MGR already set [ 382.417012] binder: 14646:14649 ioctl 40046207 0 returned -16 01:48:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x2, 0x84040) ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000000140)={0xd000, 0xf001, 0x0, 0x20, 0x9}) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) mincore(&(0x7f0000ffe000/0x1000)=nil, 0x1000, &(0x7f00000001c0)=""/122) recvfrom$inet6(r2, &(0x7f0000000240)=""/114, 0x72, 0x20, &(0x7f00000002c0)={0xa, 0x4e21, 0x35, @initdev={0xfe, 0x88, [], 0x9, 0x0}, 0x401}, 0x1c) accept4$inet(r1, 0x0, &(0x7f0000000080), 0x80000) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x40) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x1}}, 0x4fffffc) [ 382.454397] binder_alloc: 14646: binder_alloc_buf, no vma [ 382.479303] binder: 14646:14665 transaction failed 29189/-3, size 0-0 line 3035 01:48:02 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x2f, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 382.514874] binder: release 14646:14649 transaction 343 out, still active 01:48:02 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 382.555067] binder: undelivered TRANSACTION_COMPLETE 01:48:02 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x100000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 382.610142] binder: send failed reply for transaction 343, target dead 01:48:02 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x101, 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x2, 0x0) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000100)={0x6, 0x1, @raw_data=[0x1, 0x1, 0x81, 0x1, 0x10000, 0x6, 0x2, 0xffffffff7fffffff, 0x3290, 0x8, 0xec4b, 0x22, 0xffffffff, 0x100, 0xffffffff80000001, 0x80000000]}) 01:48:02 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:03 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x33, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 382.769506] binder: BINDER_SET_CONTEXT_MGR already set [ 382.781044] binder_alloc: 14685: binder_alloc_buf, no vma [ 382.788176] binder: 14685:14686 ioctl 40046207 0 returned -16 [ 382.799893] binder: send failed reply for transaction 346 to 14685:14686 [ 382.839925] binder: undelivered TRANSACTION_COMPLETE 01:48:03 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x6, 0x80) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:48:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x200000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:03 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x3a, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:03 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 383.108279] binder: BINDER_SET_CONTEXT_MGR already set 01:48:03 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 383.149035] binder_alloc: 14705: binder_alloc_buf, no vma [ 383.179661] binder: 14705:14709 ioctl 40046207 0 returned -16 [ 383.193403] binder: release 14705:14709 transaction 349 out, still active [ 383.212514] binder_transaction: 1 callbacks suppressed [ 383.212533] binder: 14705:14712 transaction failed 29189/-3, size 0-0 line 3035 [ 383.248462] binder: undelivered TRANSACTION_COMPLETE [ 383.265391] binder: send failed reply for transaction 349, target dead 01:48:03 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:03 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x3b, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) getsockname(r0, &(0x7f0000000040)=@rc, &(0x7f0000000100)=0x80) 01:48:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x300000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:03 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:03 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 383.430063] binder_alloc_mmap_handler: 2 callbacks suppressed [ 383.430092] binder_alloc: binder_alloc_mmap_handler: 14730 20001000-20004000 already mapped failed -16 01:48:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) fsetxattr$security_smack_transmute(r0, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x2) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = open(&(0x7f0000000100)='./file0\x00', 0x20002, 0xe8) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, &(0x7f00000003c0)={0x0, 0x0, 0x2080}) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000140)={0x59}) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="c4683d97096c2ab9444f677b1e44288fb23b42137ecfbeea532c81913d01b72eb739e63e2539a4b805c6473221c4e33fda2fdd03c135805c67ed3471f421aa5b4087464140ab766e161fd06c99b2e828479715097036e1537a1ffa5c55f3dd4c8c21"], 0x1}}, 0x5000000) 01:48:03 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0x3c, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 383.580009] binder: BINDER_SET_CONTEXT_MGR already set [ 383.604907] binder: 14730:14732 ioctl 40046207 0 returned -16 01:48:03 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff87, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:03 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000040)={@dev, @broadcast, 0x0}, &(0x7f0000000080)=0xc) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={r2, @local, @local}, 0xc) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 383.631851] binder: 14730:14747 transaction failed 29189/-3, size 0-0 line 3035 [ 383.655981] binder: release 14730:14732 transaction 352 out, still active [ 383.674910] binder: send failed reply for transaction 352, target dead 01:48:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x400000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:04 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 383.927086] binder_alloc: binder_alloc_mmap_handler: 14759 20001000-20004000 already mapped failed -16 [ 383.999486] binder: BINDER_SET_CONTEXT_MGR already set [ 384.018904] binder: 14759:14761 ioctl 40046207 0 returned -16 [ 384.054460] binder: 14759:14766 transaction failed 29189/-3, size 0-0 line 3035 [ 384.091379] binder: release 14759:14761 transaction 355 out, still active [ 384.115219] binder: send failed reply for transaction 355, target dead 01:48:04 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:04 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:04 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff88, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:04 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) getpeername(r0, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000080)=0x80) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000040}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x1c, r2, 0x100, 0x70bd25, 0x25dfdbfd, {}, ["", ""]}, 0x1c}}, 0x814) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="10db8da4e7de43c5833681f4ad54c0d0fee8acfb76abc525a7d654f39357906d969ce334404919b274fcc4a8d7e95348d2eeb4869a875a5e0f11c8725b900abd1b0eb7a6939e6d1ceb1c2d752ad1a2b2bb898bd002"], 0x1}}, 0x5000000) close(r3) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000040)=0x1) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e21, 0x80000001, @local, 0x4}}, [0x1, 0x6, 0x80000, 0x8000, 0xffff, 0xf8, 0x200, 0x8e, 0x5, 0x6b46, 0x7, 0x1000, 0x1, 0x0, 0x3]}, &(0x7f0000000280)=0x100) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f00000002c0)={r5, 0x5c0b}, &(0x7f0000000300)=0x8) 01:48:04 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x500000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 384.249334] binder_alloc: binder_alloc_mmap_handler: 14771 20001000-20004000 already mapped failed -16 01:48:04 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff89, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 384.349499] binder: BINDER_SET_CONTEXT_MGR already set [ 384.349522] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 384.349530] binder_alloc: 14771: binder_alloc_buf, no vma [ 384.354848] binder: 14771:14772 ioctl 40046207 0 returned -16 01:48:04 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="c030efe905fb51001e48b26800000000000000000000"], 0x1}}, 0x5000000) read(r0, &(0x7f0000000040)=""/248, 0xf8) [ 384.422459] binder: send failed reply for transaction 358 to 14771:14772 [ 384.458964] binder: 14771:14778 transaction failed 29189/-3, size 0-0 line 3035 01:48:04 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x2, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:04 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 384.472045] binder_release_work: 6 callbacks suppressed [ 384.472053] binder: undelivered TRANSACTION_ERROR: 29189 01:48:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x600000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 384.519336] binder_release_work: 2 callbacks suppressed [ 384.519342] binder: undelivered TRANSACTION_COMPLETE 01:48:04 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 384.589014] binder: undelivered TRANSACTION_ERROR: 29189 [ 384.611286] binder_alloc: binder_alloc_mmap_handler: 14798 20001000-20004000 already mapped failed -16 [ 384.681498] binder: BINDER_SET_CONTEXT_MGR already set [ 384.699128] binder: 14798:14799 ioctl 40046207 0 returned -16 [ 384.720149] binder_alloc: 14798: binder_alloc_buf, no vma [ 384.725910] binder: 14798:14807 transaction failed 29189/-3, size 0-0 line 3035 01:48:05 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:05 executing program 0: r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video1\x00', 0x2, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000000, 0x10, r0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) close(r1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[]}, 0x1, 0x0, 0x0, 0x4000804}, 0x8000000004000000) 01:48:05 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x3, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:05 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:05 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 384.755376] binder: undelivered TRANSACTION_ERROR: 29189 [ 384.761127] binder: send failed reply for transaction 361 to 14798:14799 [ 384.768210] binder: undelivered TRANSACTION_COMPLETE [ 384.773598] binder: undelivered TRANSACTION_ERROR: 29189 01:48:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x700000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:05 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x7, 0x7, 0xfffffffffffffc00, 0x100000000, 'syz0\x00', 0x5}) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000000, 0x10, r1, 0x0) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x7, 0x100) 01:48:05 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x4, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:05 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 385.004169] binder_alloc: binder_alloc_mmap_handler: 14827 20001000-20004000 already mapped failed -16 01:48:05 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 385.049965] binder: BINDER_SET_CONTEXT_MGR already set 01:48:05 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x5, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 385.093241] binder: 14827:14828 ioctl 40046207 0 returned -16 01:48:05 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x101000, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000080)={0x10000, 0x3, 0x7, 0x400}, 0x8) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:48:05 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) 01:48:05 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 385.135479] binder_alloc: 14827: binder_alloc_buf, no vma [ 385.170119] binder: 14827:14840 transaction failed 29189/-3, size 0-0 line 3035 01:48:05 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x6, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xa00000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:05 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 385.297536] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.315087] binder: send failed reply for transaction 364 to 14827:14828 01:48:05 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 385.354543] binder: undelivered TRANSACTION_COMPLETE [ 385.391004] binder: undelivered TRANSACTION_ERROR: 29189 01:48:05 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) 01:48:05 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x7, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 385.486464] binder_alloc: binder_alloc_mmap_handler: 14857 20001000-20004000 already mapped failed -16 01:48:05 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f00000001c0)="8c14e7499fe767860b231641ef6775d5f04a35ac5fa9e09a1f7b22ca50f81685fb0217a421f3639f45516dc81194dc21ca4738e772bb8d4ad176fca2b984a37352437b38bf56e1ba2b39498bedb7a4be3b34d82406b59b84a7764120da5e", &(0x7f0000000240)="01bd90450d9ae0f7c56b664f72f2a1e15fd25130c9270a26444f50dfa0f0716af87796fce766ff2aee2cf115b386d2ae55804f0f62c4b1af100d5ed92a95d07e37e11ce564eebb0627671899588cec6f0f544c0bd99cc3dc82bf34499ee738e2e43d9e5eab", 0x2}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x8802, 0x0) write$P9_RAUTH(r2, &(0x7f0000000300)={0x14, 0x67, 0x1, {0x10, 0x2, 0x1}}, 0x14) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-monitor\x00', 0x40, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x200, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000080)) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) [ 385.546987] binder_alloc: 14857: binder_alloc_buf, no vma [ 385.547381] binder: BINDER_SET_CONTEXT_MGR already set [ 385.582152] binder: 14857:14872 ioctl 40046207 0 returned -16 01:48:05 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 385.602904] binder: 14857:14859 transaction failed 29189/-3, size 0-0 line 3035 [ 385.617967] binder: release 14857:14859 transaction 367 out, still active 01:48:05 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x8, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:05 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) [ 385.644688] binder: undelivered TRANSACTION_COMPLETE 01:48:05 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 385.689375] binder: send failed reply for transaction 367, target dead 01:48:06 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) socketpair(0x17, 0x6, 0x1, &(0x7f0000000040)) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) 01:48:06 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x9, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 385.782795] binder: undelivered TRANSACTION_ERROR: 29189 01:48:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x1200000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:06 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) 01:48:06 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:06 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xe, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 385.982468] binder_alloc: binder_alloc_mmap_handler: 14901 20001000-20004000 already mapped failed -16 01:48:06 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) 01:48:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:06 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='gid_map\x00') ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, &(0x7f0000000140)={0x1, 0x0, [{}]}) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x1, @dev={[], 0x2a}, 'teql0\x00'}}, 0x1e) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) bind$unix(r2, &(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e) r3 = msgget$private(0x0, 0x80) msgctl$MSG_INFO(r3, 0xc, &(0x7f00000001c0)=""/227) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="3dd566ad7119bbad4e8163db4def141dae21648ac325b902488895dea1a4ccf8601d280430"], 0x1}}, 0x5000000) [ 386.071102] binder_alloc: 14901: binder_alloc_buf, no vma [ 386.076719] binder: 14901:14904 transaction failed 29189/-3, size 0-0 line 3035 [ 386.146852] binder: release 14901:14902 transaction 370 out, still active [ 386.168704] binder: undelivered TRANSACTION_COMPLETE [ 386.174311] binder: undelivered TRANSACTION_ERROR: 29189 01:48:06 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x2000000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:06 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 386.217583] binder: send failed reply for transaction 370, target dead 01:48:06 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000200)='net/dev\x00') ioctl$VIDIOC_S_AUDOUT(r2, 0x40345632, &(0x7f0000000240)={0x2, "cca6baea009fc55894c6eb37b4cf374c3c0e3b07ae5486934018397735c054e4", 0x1, 0x1}) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x4000, 0x0) sendmsg$nl_route(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x21000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@ipv6_getmulticast={0x14, 0x3a, 0x402, 0x70bd28, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) 01:48:06 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 386.347961] binder_alloc: binder_alloc_mmap_handler: 14931 20001000-20004000 already mapped failed -16 01:48:06 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x13, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 386.441251] binder: BINDER_SET_CONTEXT_MGR already set [ 386.469717] binder: 14931:14932 ioctl 40046207 0 returned -16 [ 386.476275] binder_alloc: 14931: binder_alloc_buf, no vma 01:48:06 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 386.515910] binder: release 14931:14932 transaction 373 out, still active [ 386.525670] binder: undelivered TRANSACTION_COMPLETE [ 386.531426] binder: 14931:14949 transaction failed 29189/-3, size 0-0 line 3035 01:48:06 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:06 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="70510a0e7a6a79c03eaabfc9b5eb255d61dab84a3eb6513fd9ddc37469f394c75fc932d4c000b9bd6ebf0a09a3d8d3fe595cb12c3f2bcba5b34f2b5d"], 0x1}}, 0x5000000) 01:48:06 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x47, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 386.558603] binder: send failed reply for transaction 373, target dead 01:48:06 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 386.629918] binder: undelivered TRANSACTION_ERROR: 29189 01:48:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x3f00000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:06 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:07 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x3de) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008004) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x1}}, 0x5000000) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x24000) write$UHID_CREATE(r2, &(0x7f00000001c0)={0x0, 'syz1\x00', 'syz0\x00', 'syz0\x00', &(0x7f00000003c0)=""/4096, 0x1000, 0x3ff, 0x8, 0x1, 0x4, 0x8}, 0x120) 01:48:07 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:07 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x60, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 386.809822] binder_alloc: binder_alloc_mmap_handler: 14968 20001000-20004000 already mapped failed -16 [ 386.827641] binder: BINDER_SET_CONTEXT_MGR already set 01:48:07 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) 01:48:07 executing program 0: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x44d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ptype\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001f9, 0x0) 01:48:07 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 386.998894] binder: 14968:14969 ioctl 40046207 0 returned -16 [ 387.063741] binder: release 14968:14969 transaction 376 out, still active [ 387.075899] binder: undelivered TRANSACTION_COMPLETE 01:48:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000240)=ANY=[@ANYBLOB="05000000000000000d000040050000a900000000000000000000004000000000010000000000000025000000ff"]) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008004"]) 01:48:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4800000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 387.122222] binder: send failed reply for transaction 376, target dead 01:48:07 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x300, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:07 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='clear_refs\x00') write$FUSE_NOTIFY_DELETE(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB='5'], 0x1) 01:48:07 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) [ 387.312672] binder_alloc: binder_alloc_mmap_handler: 15004 20001000-20004000 already mapped failed -16 [ 387.371610] binder: BINDER_SET_CONTEXT_MGR already set [ 387.403741] binder: 15004:15005 ioctl 40046207 0 returned -16 [ 387.447381] binder_alloc: 15004: binder_alloc_buf, no vma [ 387.495148] binder: send failed reply for transaction 378 to 15004:15005 [ 387.520457] binder: undelivered TRANSACTION_COMPLETE [ 387.538678] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.547514] binder: 15004:15012 transaction failed 29189/-3, size 0-0 line 3035 01:48:07 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:07 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x500, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:07 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) 01:48:07 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, &(0x7f0000000280)="d5", 0x1, 0x8005, 0x0, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) 01:48:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x4c00000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:07 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000300)={{0x80, 0x800000}, 'port0\x00', 0x6, 0x2, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, 0x0) [ 387.760420] binder: BINDER_SET_CONTEXT_MGR already set 01:48:08 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x600, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 387.785544] binder_alloc: 15019: binder_alloc_buf, no vma [ 387.815445] binder: release 15019:15029 transaction 381 out, still active [ 387.824008] binder: 15019:15029 ioctl 40046207 0 returned -16 01:48:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x1a02100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000240), 0x4) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="c47a2ef62121d45dc326c519347bdbdf", 0x10) 01:48:08 executing program 4: ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000980)={0x0, 0xffffffffffffff9c, 0x0, 0x6, &(0x7f0000000940)='{user\x00'}, 0x30) perf_event_open(&(0x7f00000008c0)={0x1, 0x70, 0x401, 0x200, 0x32a, 0xff, 0x0, 0x7fffffff, 0x10200, 0x8, 0x3f, 0x400, 0x0, 0x20000, 0x5, 0x0, 0x945a00000000, 0x3, 0x0, 0x0, 0x7, 0x7, 0x3, 0x4, 0xff, 0x6, 0x4, 0x1, 0x9, 0x1, 0x6f5, 0x100000000, 0xffffffffffffffc1, 0x3a, 0x2, 0xb35, 0xffffffffffff8000, 0x487e, 0x0, 0xc143, 0x6, @perf_config_ext={0x9, 0x80000000}, 0x0, 0xffffffffffffffff, 0x3f, 0xf, 0x8f8, 0xa84b, 0x9}, r0, 0xa, 0xffffffffffffffff, 0x8) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x29, 0x7, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r2, &(0x7f0000000080)={&(0x7f0000000000)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x8953, &(0x7f0000000040)=0x2) [ 387.844225] binder: undelivered TRANSACTION_COMPLETE 01:48:08 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) 01:48:08 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 387.876532] binder: send failed reply for transaction 381, target dead 01:48:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6000000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:08 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x700, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 388.036963] binder: BINDER_SET_CONTEXT_MGR already set 01:48:08 executing program 4: [ 388.064873] binder_alloc: 15054: binder_alloc_buf, no vma [ 388.089320] binder: release 15054:15055 transaction 384 out, still active [ 388.096280] binder: undelivered TRANSACTION_COMPLETE [ 388.104071] binder: 15054:15056 ioctl 40046207 0 returned -16 01:48:08 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:08 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) [ 388.154966] binder: send failed reply for transaction 384, target dead 01:48:08 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x900, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6800000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000240)=ANY=[@ANYBLOB="05000000000000000d000040050000a900000000000000000000004000000000010000000000000025000000fff0ffff04040000000000000a00000006"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008d03"]) [ 388.321542] binder: BINDER_SET_CONTEXT_MGR already set [ 388.363418] binder: 15075:15076 ioctl 40046207 0 returned -16 [ 388.363467] binder_alloc: 15075: binder_alloc_buf, no vma [ 388.403042] binder: send failed reply for transaction 387 to 15075:15076 [ 388.433901] binder_transaction: 2 callbacks suppressed [ 388.433917] binder: 15075:15079 transaction failed 29189/-3, size 0-0 line 3035 01:48:09 executing program 0: syz_open_dev$ndb(&(0x7f0000000180)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) 01:48:09 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, 0x0, 0x0, 0x0) 01:48:09 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xe00, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x6c00000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:09 executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) write$P9_RLINK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) pwritev(0xffffffffffffffff, 0x0, 0xfffffffffffffc98, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) getgid() listen(r1, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) r2 = accept4$inet(r1, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) creat(0x0, 0x0) write$P9_RLINK(0xffffffffffffffff, 0x0, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000000)) [ 388.861744] binder_alloc_mmap_handler: 3 callbacks suppressed [ 388.861763] binder_alloc: binder_alloc_mmap_handler: 15095 20001000-20004000 already mapped failed -16 01:48:09 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf00, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 388.938763] binder: BINDER_SET_CONTEXT_MGR already set [ 388.960965] binder: 15095:15096 ioctl 40046207 0 returned -16 01:48:09 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) [ 388.991257] binder: 15095:15109 transaction failed 29189/-3, size 0-0 line 3035 [ 389.029104] binder: send failed reply for transaction 390 to 15095:15096 01:48:09 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) 01:48:09 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) eventfd(0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x2100, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100080}, 0xc, &(0x7f0000000100)={&(0x7f0000000b80)=ANY=[@ANYBLOB="020027bd7000fddbdf25060000001c0060869b22eb4e7907e9ff0700030004000000080005007f00000148ffff00080006006e71000008000900fdffffff08000500010000000800080001000000080004004e2200000800050000000000140007001000000000000000080001000800090000020000080002004e24000008000500040000000800060001000080080002004e21000028000300080007004e23000008000300040000001400060000000000000000000000000000000000080005000000000048000100080006006e710000080001000200000008000b00736970000c0006006e6f6e650000000014000300e00000020000000000000000000000000c8ad2894d5196724df9bc0e0006006e6f6e65000001008524780b1aa6d544501a78f52b42cd5ec35aca23f2d7f47de02db85f131c5e93069b11f8d762229d18b5a9586ea0df692a7871e940d39449648284f800065a73ebc330e7f6b5779a743530462eb87deca49a4b698eccdc1db03a44dc06d69ea97eaa5ba9be65c03b058c2a1fa6aef23f14de55a0f1f0f337fc356624b3bdcd4a19e5013b417fe2ed0c469b1060eda4843eba1de70feceb5a58938a3e7cda1e89875ccd98d6797c157a33174ae4ea087a658188ec85ec305497e01ea9f8ed530264076bbab2d7b44ed09d8b0ba15080eaaf96ec25687d99961fc5a0307bd981909168520f55bf691d5141517536c1e13009ce6dcf4938d00af3d39bd91f265a78a9d59ebdfc648247503676d50ef1e5d530efbed44e73662cd1a50224de4e8b8790b648b411f8d06d1a322f374bc9f674e91aef1d687c7f53e2f1cdff25a79067a9f3f3ab4f3effe9aa5a185e9282ff0fe242ff95dfa4286fbe6b8ab3bef4e0eb49683acf252fcb40525026a2e7adf00430f68c2b4d28068f701b099574c39b7a787f65fc0a78b23cd6"], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) mkdir(&(0x7f00000001c0)='./file0\x00', 0xfffffffffffffffc) mount(&(0x7f0000000540)=ANY=[], &(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f00000003c0)={0x1, 0x374, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x240, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000500)='./file0//ile0\x00', &(0x7f0000000540)) getgroups(0x6, &(0x7f00000005c0)=[0xffffffffffffffff, 0x0, 0x0, 0xee00, 0xee01, 0x0]) write$binfmt_elf64(r1, &(0x7f0000000940)={{0x7f, 0x45, 0x4c, 0x46, 0xffffffffffffffc3, 0x2, 0xd8, 0x0, 0x6, 0x3, 0x7, 0x2, 0x15b, 0x40, 0x3df, 0x6, 0x6962714c, 0x38, 0x2, 0x2, 0x4, 0x3}, [{0x4, 0x7, 0x81, 0x4, 0x0, 0x8, 0x100000000, 0x7f}, {0x6, 0x2, 0x800, 0x6, 0xff, 0x8001, 0x9d, 0x3}], "510fba9e06c9ffe693423948519ae28eeebbd604129366c783eb893bf52068bb915721d3feb979c2e055f91fdd3be4830f55be915d33c54aefddb1125d3fe7d78a91ca27989ecc94a31ad07656d3309b5663de1d9e843e"}, 0x107) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000680)=0xc) getresgid(&(0x7f00000006c0)=0x0, &(0x7f0000000700), &(0x7f0000000740)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000780)={0x0, 0x0, 0x0}, &(0x7f00000007c0)=0xc) setregid(r3, r4) rmdir(&(0x7f0000000240)='./file2\x00') chdir(&(0x7f0000000280)='./file1\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) io_setup(0x5, &(0x7f0000000180)=0x0) io_destroy(r5) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) inotify_rm_watch(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) eventfd2(0x10001, 0x0) creat(&(0x7f0000000440)='./file1\x00', 0x1) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000480)=0x0) sched_setaffinity(r6, 0x8, &(0x7f00000004c0)=0x80) 01:48:09 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000000000000bfa30000000000000703000020feffff7a0af0fff8ffffff79a4f0ff00000000b7060000000000012d640300000000006504040001ed0ebb1c04000000000000b7050000000000000f03000000000000850000002e000000b7000000000000009500000000000000"], 0x0}, 0x48) 01:48:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7400000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:09 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x1300, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:09 executing program 4: 01:48:09 executing program 5: 01:48:09 executing program 4: 01:48:09 executing program 5: [ 389.307560] binder_alloc: binder_alloc_mmap_handler: 15130 20001000-20004000 already mapped failed -16 01:48:09 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x1f00, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:09 executing program 0: 01:48:09 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) [ 389.395380] binder: BINDER_SET_CONTEXT_MGR already set 01:48:09 executing program 4: [ 389.450239] binder: 15130:15131 ioctl 40046207 0 returned -16 [ 389.466804] binder: send failed reply for transaction 393 to 15130:15131 [ 389.480668] binder_release_work: 7 callbacks suppressed [ 389.480675] binder: undelivered TRANSACTION_ERROR: 29189 01:48:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x7a00000000000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:09 executing program 0: 01:48:09 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x3f00, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:09 executing program 5: 01:48:09 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040), 0x0, 0x0) 01:48:09 executing program 4: [ 389.632111] binder_alloc: binder_alloc_mmap_handler: 15158 20001000-20004000 already mapped failed -16 01:48:09 executing program 0: 01:48:09 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x4700, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 389.718627] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 389.718636] binder_alloc: 15158: binder_alloc_buf, no vma [ 389.719568] binder: BINDER_SET_CONTEXT_MGR already set [ 389.741280] binder: 15158:15162 transaction failed 29189/-3, size 0-0 line 3035 01:48:10 executing program 5: 01:48:10 executing program 4: [ 389.821494] binder: send failed reply for transaction 395 to 15158:15161 [ 389.828988] binder: 15158:15161 ioctl 40046207 0 returned -16 01:48:10 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) [ 389.864641] binder_release_work: 3 callbacks suppressed [ 389.864647] binder: undelivered TRANSACTION_COMPLETE [ 389.894255] binder: undelivered TRANSACTION_ERROR: 29189 01:48:10 executing program 0: [ 389.929133] binder: undelivered TRANSACTION_ERROR: 29189 01:48:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0xfdfdffff00000000, &(0x7f0000000700)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:10 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x6000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:10 executing program 5: 01:48:10 executing program 4: 01:48:10 executing program 0: 01:48:10 executing program 5: 01:48:10 executing program 4: [ 390.092765] binder_alloc: binder_alloc_mmap_handler: 15190 20001000-20004000 already mapped failed -16 01:48:10 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:10 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 390.171600] binder: BINDER_SET_CONTEXT_MGR already set 01:48:10 executing program 0: 01:48:10 executing program 5: [ 390.247341] binder: release 15190:15195 transaction 398 out, still active [ 390.257172] binder: 15190:15195 ioctl 40046207 0 returned -16 [ 390.268779] binder: undelivered TRANSACTION_COMPLETE 01:48:10 executing program 4: [ 390.299057] binder: send failed reply for transaction 398, target dead 01:48:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x630b, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:10 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x40000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:10 executing program 5: 01:48:10 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{0x0}], 0x1, 0x0) 01:48:10 executing program 4: 01:48:10 executing program 0: [ 390.514925] binder: 15226:15227 ERROR: BC_REGISTER_LOOPER called without request 01:48:10 executing program 5: 01:48:10 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf0ffff, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:10 executing program 4: [ 390.577959] binder: 15226:15227 unknown command 0 01:48:10 executing program 0: [ 390.612308] binder: 15226:15227 ioctl c0306201 200002c0 returned -22 01:48:10 executing program 1: [ 390.689296] binder_alloc: binder_alloc_mmap_handler: 15226 20001000-20004000 already mapped failed -16 01:48:10 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x1000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 390.731513] binder: BINDER_SET_CONTEXT_MGR already set [ 390.781537] binder: 15226:15227 ioctl 40046207 0 returned -16 [ 390.818878] binder_alloc: 15226: binder_alloc_buf, no vma [ 390.876205] binder: 15226:15243 transaction failed 29189/-3, size 0-0 line 3035 [ 390.891377] binder: send failed reply for transaction 400 to 15226:15227 [ 390.917788] binder: undelivered TRANSACTION_COMPLETE 01:48:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x630c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:11 executing program 4: 01:48:11 executing program 0: 01:48:11 executing program 5: 01:48:11 executing program 1: 01:48:11 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x2000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 390.939252] binder: undelivered TRANSACTION_ERROR: 29189 [ 390.944791] binder: undelivered TRANSACTION_ERROR: 29189 01:48:11 executing program 4: 01:48:11 executing program 5: 01:48:11 executing program 0: 01:48:11 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x3000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:11 executing program 1: [ 391.109772] binder: 15253:15263 unknown command 0 [ 391.114687] binder: 15253:15263 ioctl c0306201 200002c0 returned -22 01:48:11 executing program 5: r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000180)='/dev/capi20\x00', 0x0, 0x0) ioctl$CAPI_GET_ERRCODE(r0, 0x80044326, &(0x7f0000000100)) [ 391.235526] binder_alloc: binder_alloc_mmap_handler: 15253 20001000-20004000 already mapped failed -16 [ 391.308017] binder: BINDER_SET_CONTEXT_MGR already set [ 391.342098] binder: 15253:15263 ioctl 40046207 0 returned -16 [ 391.371831] binder_alloc: 15253: binder_alloc_buf, no vma [ 391.394145] binder: 15253:15279 transaction failed 29189/-3, size 0-0 line 3035 [ 391.404997] binder: release 15253:15263 transaction 403 out, still active [ 391.422461] binder: undelivered TRANSACTION_COMPLETE [ 391.427648] binder: undelivered TRANSACTION_ERROR: 29189 01:48:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:11 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x4000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:11 executing program 4: bind$inet6(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) set_mempolicy(0x2, &(0x7f0000000000)=0x6, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x400002, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x2598730c}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000003c0)={r1, 0xb4, &(0x7f0000000300)=[@in={0x2, 0x4e21, @rand_addr=0xffffffffffffffe0}, @in={0x2, 0x4e23, @broadcast}, @in6={0xa, 0x4e23, 0x100000001, @mcast2, 0x5}, @in6={0xa, 0x4e23, 0x1000, @mcast1, 0x3}, @in={0x2, 0x4e20, @empty}, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e20, 0x0, @empty, 0x1f}, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e24, @broadcast}]}, &(0x7f0000000400)=0x10) r2 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f00000001c0)) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio\x00', 0x2000000140202, 0x0) ioctl$GIO_UNIMAP(r3, 0x4b66, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)}}, 0x20) socket$alg(0x26, 0x5, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f000000afee)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405) r5 = socket$l2tp(0x18, 0x1, 0x1) dup2(r4, r3) r6 = syz_open_dev$usbmon(0x0, 0xfffffffffffffffe, 0x0) epoll_create(0x7) ioctl$sock_SIOCSIFBR(r6, 0x8941, &(0x7f0000000080)=@add_del={0x2, 0x0, 0x4}) openat(0xffffffffffffffff, 0x0, 0x40000, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) lstat(0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@dev, @in6=@local}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000280)=0xe8) bind$vsock_dgram(r5, &(0x7f0000000180)={0x28, 0x0, 0xffffffff}, 0x10) write$P9_RSTATu(0xffffffffffffffff, 0x0, 0x0) ioctl$RTC_SET_TIME(0xffffffffffffffff, 0x4024700a, 0x0) r7 = syz_open_dev$ndb(&(0x7f0000000180)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_sctp_SIOCINQ(r8, 0x541b, &(0x7f0000000000)) ioctl$NBD_CLEAR_SOCK(r7, 0xab04) 01:48:11 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000240)=ANY=[@ANYBLOB="05000000000000000d000040050000a900000000000000000000004000000000010000000000000025000000fff0ffff04040000000000000a00000006"]) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008d03"]) 01:48:11 executing program 0: clone(0x400002100001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x1, 0x164, [0x0, 0x20000180, 0x200001b0, 0x200002b4], 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000000b00000000000000000062637368300000000000000000000000626373683000000000000000000000006263736630000000000000000000000069666230000000000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000ac000000ac000000d40000006c696d6974000000000000000000000000000000000000000000000000000000180000000040000e00100000000000000000000000000000000000004155444954000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff00000000"]}, 0x1dc) io_cancel(0x0, 0x0, 0x0) 01:48:11 executing program 5: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x17) ptrace$cont(0x18, r0, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x2b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 391.454851] binder: send failed reply for transaction 403, target dead 01:48:11 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:11 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x5000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 391.502174] ptrace attach of "/root/syz-executor5"[15285] was attempted by "/root/syz-executor5"[15295] [ 391.562388] binder: 15296:15297 unknown command 0 01:48:11 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 391.618698] binder: 15296:15297 ioctl c0306201 200002c0 returned -22 [ 391.646169] binder_alloc: binder_alloc_mmap_handler: 15296 20001000-20004000 already mapped failed -16 01:48:11 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x6000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 391.717800] binder: BINDER_SET_CONTEXT_MGR already set 01:48:11 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 391.759639] binder: 15296:15297 ioctl 40046207 0 returned -16 [ 391.787856] binder: release 15296:15297 transaction 406 out, still active [ 391.805474] binder: undelivered TRANSACTION_COMPLETE [ 391.837545] binder: send failed reply for transaction 406, target dead 01:48:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40046302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:12 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:12 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x7000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 392.006487] binder: BC_ACQUIRE_RESULT not supported [ 392.054691] binder: 15324:15326 ioctl c0306201 200002c0 returned -22 [ 392.121213] binder_alloc: binder_alloc_mmap_handler: 15324 20001000-20004000 already mapped failed -16 01:48:12 executing program 4: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:12 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x8000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 392.164339] binder: BINDER_SET_CONTEXT_MGR already set 01:48:12 executing program 1: madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:12 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 392.270620] binder: 15324:15326 ioctl 40046207 0 returned -16 01:48:12 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x9000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 392.368731] binder_alloc: 15324: binder_alloc_buf, no vma [ 392.400011] binder: 15324:15344 transaction failed 29189/-3, size 0-0 line 3035 [ 392.416144] binder: send failed reply for transaction 408 to 15324:15326 01:48:12 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xe000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 392.489041] binder: undelivered TRANSACTION_ERROR: 29189 [ 392.494589] binder: undelivered TRANSACTION_COMPLETE [ 392.562793] binder: undelivered TRANSACTION_ERROR: 29189 01:48:12 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40046304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:12 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:12 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:12 executing program 4: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x8dffffff00000000, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 392.801899] binder: 15356:15364 unknown command 0 01:48:13 executing program 0: syz_open_dev$sndtimer(0x0, 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:13 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x13000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 392.840760] binder: 15356:15364 ioctl c0306201 200002c0 returned -22 [ 392.879225] binder_alloc: binder_alloc_mmap_handler: 15356 20001000-20004000 already mapped failed -16 01:48:13 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 392.919303] binder: BINDER_SET_CONTEXT_MGR already set 01:48:13 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 393.023115] binder: 15356:15364 ioctl 40046207 0 returned -16 [ 393.023541] binder_alloc: 15356: binder_alloc_buf, no vma 01:48:13 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x1f000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 393.136512] binder: 15356:15378 transaction failed 29189/-3, size 0-0 line 3035 01:48:13 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 393.185356] binder: send failed reply for transaction 411 to 15356:15364 [ 393.239003] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.244610] binder: undelivered TRANSACTION_COMPLETE 01:48:13 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x3f000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 393.288689] binder: undelivered TRANSACTION_ERROR: 29189 01:48:13 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:13 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40046307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:13 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x47000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 393.446726] binder: 15393:15397 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 393.495083] binder: 15393:15397 unknown command 0 [ 393.512127] binder: 15393:15397 ioctl c0306201 200002c0 returned -22 01:48:13 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:13 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 393.571190] binder_alloc: binder_alloc_mmap_handler: 15393 20001000-20004000 already mapped failed -16 [ 393.595242] binder: BINDER_SET_CONTEXT_MGR already set [ 393.612710] binder_alloc: 15393: binder_alloc_buf, no vma 01:48:13 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:13 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x60000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 393.663383] binder: release 15393:15397 transaction 415 out, still active [ 393.670829] binder: 15393:15397 ioctl 40046207 0 returned -16 [ 393.676774] binder: undelivered TRANSACTION_COMPLETE [ 393.721140] binder: send failed reply for transaction 415, target dead [ 393.728468] binder: 15393:15406 transaction failed 29189/-3, size 0-0 line 3035 01:48:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40086303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:14 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x8dffffff, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 393.990817] binder: 15422:15426 BC_FREE_BUFFER u0000000000000000 no match 01:48:14 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:14 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf5ffffff, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 394.076987] binder: 15422:15426 unknown command 0 [ 394.128882] binder: 15422:15426 ioctl c0306201 200002c0 returned -22 [ 394.160932] binder_alloc: binder_alloc_mmap_handler: 15422 20001000-20004000 already mapped failed -16 01:48:14 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) 01:48:14 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xfffff000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 394.206664] binder: BINDER_SET_CONTEXT_MGR already set 01:48:14 executing program 1: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf5ffffff, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 394.253938] binder: 15422:15426 ioctl 40046207 0 returned -16 01:48:14 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) [ 394.337249] binder_alloc: 15422: binder_alloc_buf, no vma 01:48:14 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xffffff8d, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:14 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 394.391791] binder: 15422:15443 transaction failed 29189/-3, size 0-0 line 3035 [ 394.399528] binder: send failed reply for transaction 418 to 15422:15426 [ 394.420637] binder: undelivered TRANSACTION_COMPLETE 01:48:14 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) 01:48:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x4008630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:14 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xfffffff5, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 394.604618] binder: BC_ATTEMPT_ACQUIRE not supported [ 394.648942] binder: 15459:15460 ioctl c0306201 200002c0 returned -22 01:48:14 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) [ 394.702868] binder_alloc: binder_alloc_mmap_handler: 15459 20001000-20004000 already mapped failed -16 [ 394.798745] binder: BINDER_SET_CONTEXT_MGR already set [ 394.827403] binder: 15459:15460 ioctl 40046207 0 returned -16 01:48:15 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x4000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:15 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) [ 394.874070] binder: release 15459:15460 transaction 421 out, still active [ 394.874086] binder: BC_ATTEMPT_ACQUIRE not supported [ 394.884888] binder: undelivered TRANSACTION_COMPLETE [ 394.928617] binder: 15459:15462 ioctl c0306201 200002c0 returned -22 [ 394.976008] binder: send failed reply for transaction 421, target dead 01:48:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) 01:48:15 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf0ffffffffffff, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40086310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:15 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) [ 395.190725] binder: 15484:15489 BC_DEAD_BINDER_DONE 0000000000000000 not found 01:48:15 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) [ 395.231211] binder: 15484:15489 unknown command 0 01:48:15 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x100000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 395.264522] binder: 15484:15489 ioctl c0306201 200002c0 returned -22 [ 395.344014] binder_alloc: binder_alloc_mmap_handler: 15484 20001000-20004000 already mapped failed -16 01:48:15 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r3, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) [ 395.399619] binder_alloc: 15484: binder_alloc_buf, no vma [ 395.417723] binder: BINDER_SET_CONTEXT_MGR already set 01:48:15 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x200000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 395.448456] binder: 15484:15496 transaction failed 29189/-3, size 0-0 line 3035 01:48:15 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) [ 395.514394] binder: release 15484:15489 transaction 423 out, still active [ 395.522219] binder: 15484:15499 ioctl 40046207 0 returned -16 [ 395.535345] binder: undelivered TRANSACTION_COMPLETE [ 395.591966] binder_release_work: 3 callbacks suppressed [ 395.591973] binder: undelivered TRANSACTION_ERROR: 29189 01:48:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x400c630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:15 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x300000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 395.667744] binder: send failed reply for transaction 423, target dead 01:48:15 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f000000bdc0)={{{@in=@initdev, @in=@dev}}, {{}, 0x0, @in=@multicast1}}, &(0x7f000000bec0)=0xe8) [ 395.733937] binder: 15513:15514 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 395.827973] binder: 15513:15514 unknown command 0 01:48:16 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x10001) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x989f261587be0f45, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) accept$packet(r2, &(0x7f00000016c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001700)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000017c0)={'team0\x00'}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001800)={'lo\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000018c0)={{{@in=@loopback, @in6=@initdev}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000019c0)=0xe8) accept(r2, &(0x7f0000001a00)=@hci, &(0x7f0000001a80)=0x80) accept4(r2, &(0x7f0000003100)=@xdp, &(0x7f0000003180)=0x80, 0x80800) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000003240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000032c0)={'vcan0\x00'}) getpeername$packet(r3, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000004740)=0x14) recvmmsg(r2, &(0x7f000000bc00)=[{{&(0x7f0000004a00)=@can, 0x80, &(0x7f0000004c00)=[{&(0x7f0000004a80)=""/59, 0x3b}, {&(0x7f0000004ac0)=""/12, 0xc}, {&(0x7f0000004b00)=""/59, 0x3b}, {&(0x7f0000004b40)=""/173, 0xad}], 0x4, &(0x7f0000004c40)=""/117, 0x75}, 0x10001}, {{0x0, 0x0, &(0x7f0000004e80)=[{&(0x7f0000004cc0)=""/107, 0x6b}, {&(0x7f0000004d40)}, {&(0x7f0000004d80)=""/227, 0xe3}], 0x3, &(0x7f0000004ec0)=""/95, 0x5f}, 0xd956}, {{&(0x7f0000004f40)=@nfc, 0x80, &(0x7f0000006140)=[{&(0x7f0000004fc0)=""/62, 0x3e}, {&(0x7f0000005000)=""/28, 0x1c}, {&(0x7f0000005040)=""/4096, 0x1000}, {&(0x7f0000006040)=""/139, 0x8b}, {0x0}], 0x5, &(0x7f00000061c0)=""/4096, 0x1000}, 0x120}, {{&(0x7f00000071c0)=@generic, 0x80, &(0x7f00000075c0)=[{&(0x7f0000007240)=""/148, 0x94}, {&(0x7f0000007300)=""/131, 0x83}, {0x0}, {&(0x7f0000007440)=""/120, 0x78}, {&(0x7f00000074c0)=""/112, 0x70}, {&(0x7f0000007540)=""/71, 0x47}], 0x6, &(0x7f0000007640)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000008640)=@hci, 0x80, &(0x7f000000a780)=[{&(0x7f00000086c0)=""/4096, 0x1000}, {&(0x7f00000096c0)=""/4096, 0x1000}, {&(0x7f000000a6c0)=""/136, 0x88}], 0x3, &(0x7f000000a7c0)=""/4096, 0x1000}, 0x8001}, {{&(0x7f000000b7c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f000000bac0)=[{&(0x7f000000b840)=""/224, 0xe0}, {&(0x7f000000b940)=""/255, 0xff}, {&(0x7f000000ba40)=""/82, 0x52}], 0x3, &(0x7f000000bb00)=""/252, 0xfc}, 0x7}], 0x6, 0x2000, &(0x7f000000bd80)) 01:48:16 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x400000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 395.852213] binder: 15513:15514 ioctl c0306201 200002c0 returned -22 [ 395.930309] binder_alloc: binder_alloc_mmap_handler: 15513 20001000-20004000 already mapped failed -16 01:48:16 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x500000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 395.977324] binder: BINDER_SET_CONTEXT_MGR already set [ 396.018669] binder: 15513:15514 ioctl 40046207 0 returned -16 [ 396.018700] binder_alloc: 15513: binder_alloc_buf, no vma [ 396.057096] binder: 15513:15530 transaction failed 29189/-3, size 0-0 line 3035 01:48:16 executing program 5 (fault-call:4 fault-nth:0): syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 396.076944] binder: send failed reply for transaction 426 to 15513:15514 [ 396.107716] binder: undelivered TRANSACTION_COMPLETE 01:48:16 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x600000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 396.125025] binder: undelivered TRANSACTION_ERROR: 29189 [ 396.158986] binder: undelivered TRANSACTION_ERROR: 29189 01:48:16 executing program 4 (fault-call:4 fault-nth:0): syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:16 executing program 1 (fault-call:4 fault-nth:0): syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x400c630f, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 396.200183] FAULT_INJECTION: forcing a failure. [ 396.200183] name failslab, interval 1, probability 0, space 0, times 0 [ 396.254626] CPU: 1 PID: 15536 Comm: syz-executor5 Not tainted 5.0.0-rc1+ #15 [ 396.261879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 396.271245] Call Trace: [ 396.273859] dump_stack+0x1db/0x2d0 [ 396.277511] ? dump_stack_print_info.cold+0x20/0x20 [ 396.282558] should_fail.cold+0xa/0x15 [ 396.286486] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 396.291639] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.296414] ? __bpf_trace_preemptirq_template+0x30/0x30 01:48:16 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x700000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 396.301896] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 396.302464] binder: 15544:15546 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 396.307470] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.307495] __should_failslab+0x121/0x190 [ 396.307515] should_failslab+0x9/0x14 [ 396.307535] kmem_cache_alloc+0x47/0x710 [ 396.331379] ? mempool_alloc_slab+0x13/0x60 [ 396.335727] mempool_alloc_slab+0x47/0x60 [ 396.339901] mempool_alloc+0x19f/0x500 [ 396.343901] ? current_time+0x6e/0x1b0 [ 396.347814] ? mempool_destroy+0x40/0x40 [ 396.351900] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.356673] ? lockdep_hardirqs_on+0x415/0x5d0 [ 396.356692] ? retint_kernel+0x2d/0x2d [ 396.356708] ? trace_hardirqs_on_caller+0xc0/0x310 [ 396.356726] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.370124] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 396.370144] ? iov_iter_alignment+0x234/0xcf0 [ 396.370158] ? iov_iter_npages+0x289/0xf20 [ 396.370254] bio_alloc_bioset+0x3c1/0x720 [ 396.370275] ? iov_iter_get_pages_alloc+0x15a0/0x15a0 [ 396.398665] ? bvec_alloc+0x2f0/0x2f0 [ 396.402490] ? retint_kernel+0x2d/0x2d [ 396.406449] blkdev_direct_IO+0x371/0x13f0 [ 396.410709] ? atime_needs_update+0x47f/0x710 [ 396.412781] FAULT_INJECTION: forcing a failure. [ 396.412781] name failslab, interval 1, probability 0, space 0, times 0 [ 396.415231] ? bdev_evict_inode+0x870/0x870 [ 396.415254] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 396.415268] ? touch_atime+0x108/0x320 [ 396.415285] ? mapping_needs_writeback+0x7c/0x120 [ 396.415302] ? atime_needs_update+0x710/0x710 [ 396.440207] binder: 15544:15546 unknown command 0 [ 396.440225] binder: 15544:15546 ioctl c0306201 200002c0 returned -22 [ 396.445057] ? mapping_needs_writeback+0x7f/0x120 [ 396.445074] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 396.445097] ? filemap_check_errors+0xd8/0x110 [ 396.445126] generic_file_read_iter+0x3d9/0x2d40 [ 396.450503] FAULT_INJECTION: forcing a failure. [ 396.450503] name failslab, interval 1, probability 0, space 0, times 0 [ 396.454481] ? lockdep_hardirqs_on+0x415/0x5d0 [ 396.454500] ? retint_kernel+0x2d/0x2d [ 396.454517] ? add_lock_to_list.isra.0+0x450/0x450 [ 396.454536] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.454553] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 396.454600] ? filemap_write_and_wait_range+0xd0/0xd0 [ 396.454618] ? aa_file_perm+0x42e/0x1090 [ 396.454637] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 396.454657] ? lock_downgrade+0x910/0x910 [ 396.478504] binder_alloc: binder_alloc_mmap_handler: 15544 20001000-20004000 already mapped failed -16 [ 396.480854] ? kasan_check_read+0x11/0x20 [ 396.548253] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 396.553550] ? rcu_read_unlock_special+0x380/0x380 [ 396.558515] ? lock_is_held_type+0x17e/0x210 [ 396.562953] ? aa_file_perm+0x455/0x1090 [ 396.567038] ? add_lock_to_list.isra.0+0x450/0x450 [ 396.571999] ? aa_path_link+0x5d0/0x5d0 [ 396.575995] ? __might_fault+0x12b/0x1e0 [ 396.580072] ? find_held_lock+0x35/0x120 [ 396.584157] ? __might_fault+0x12b/0x1e0 [ 396.588237] ? lock_acquire+0x1db/0x570 [ 396.592250] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 396.597881] ? fsnotify+0x4f5/0xed0 [ 396.601538] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 396.604380] binder: BINDER_SET_CONTEXT_MGR already set [ 396.607101] blkdev_read_iter+0x120/0x190 [ 396.607125] do_iter_readv_writev+0x799/0xbc0 [ 396.607148] ? vfs_dedupe_file_range+0x780/0x780 [ 396.607172] ? rw_verify_area+0x118/0x360 [ 396.630014] do_iter_read+0x27c/0x660 [ 396.633834] ? dup_iter+0x260/0x260 [ 396.637489] vfs_readv+0x175/0x1c0 [ 396.641051] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 396.646441] ? kasan_check_write+0x14/0x20 [ 396.650694] ? __mutex_unlock_slowpath+0x195/0x870 [ 396.655649] ? __fget_light+0x2db/0x420 [ 396.659644] ? fget_raw+0x20/0x20 [ 396.663122] ? check_preemption_disabled+0x48/0x290 [ 396.668161] ? __sb_end_write+0xd9/0x110 [ 396.672252] do_preadv+0x1c4/0x280 [ 396.675815] ? do_readv+0x300/0x300 [ 396.679459] ? __ia32_sys_read+0xb0/0xb0 [ 396.683537] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 396.686762] binder: 15544:15546 ioctl 40046207 0 returned -16 [ 396.688918] ? trace_hardirqs_off_caller+0x300/0x300 [ 396.688942] __x64_sys_preadv+0x9a/0xf0 [ 396.688964] do_syscall_64+0x1a3/0x800 [ 396.688983] ? syscall_return_slowpath+0x5f0/0x5f0 [ 396.689002] ? prepare_exit_to_usermode+0x232/0x3b0 [ 396.689024] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 396.689047] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 396.727848] RIP: 0033:0x457ec9 [ 396.731058] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 396.737978] binder: send failed reply for transaction 429 to 15544:15546 [ 396.749974] RSP: 002b:00007f3332087c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 396.749990] RAX: ffffffffffffffda RBX: 00007f3332087c90 RCX: 0000000000457ec9 [ 396.749999] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000005 [ 396.750009] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 396.750018] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33320886d4 [ 396.750028] R13: 00000000004c4861 R14: 00000000004d7d20 R15: 0000000000000006 [ 396.798680] CPU: 1 PID: 15547 Comm: syz-executor4 Not tainted 5.0.0-rc1+ #15 [ 396.808408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 396.817783] Call Trace: [ 396.820394] dump_stack+0x1db/0x2d0 [ 396.824134] ? dump_stack_print_info.cold+0x20/0x20 [ 396.829167] ? __lock_acquire+0x572/0x4a30 [ 396.833426] should_fail.cold+0xa/0x15 [ 396.837335] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 396.842512] ? add_lock_to_list.isra.0+0x450/0x450 [ 396.847488] __should_failslab+0x121/0x190 [ 396.851743] should_failslab+0x9/0x14 01:48:17 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x800000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 396.855564] kmem_cache_alloc+0x47/0x710 [ 396.859676] mempool_alloc_slab+0x47/0x60 [ 396.863841] mempool_alloc+0x19f/0x500 [ 396.867745] ? current_time+0x6e/0x1b0 [ 396.871662] ? mempool_destroy+0x40/0x40 [ 396.875744] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.880521] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 396.886046] ? current_time+0x6e/0x1b0 [ 396.889953] ? trace_hardirqs_off_caller+0x300/0x300 [ 396.895101] bio_alloc_bioset+0x3c1/0x720 [ 396.899365] ? retint_kernel+0x2d/0x2d [ 396.903274] ? bvec_alloc+0x2f0/0x2f0 [ 396.907117] blkdev_direct_IO+0x371/0x13f0 [ 396.911385] ? bdev_evict_inode+0x870/0x870 [ 396.915731] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 396.921282] ? touch_atime+0x108/0x320 [ 396.925189] ? atime_needs_update+0x710/0x710 [ 396.929836] ? group_sched_in+0x17a/0x3d0 [ 396.934004] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 396.939559] ? filemap_check_errors+0xd8/0x110 [ 396.944190] generic_file_read_iter+0x3d9/0x2d40 [ 396.948966] ? pinned_sched_in+0xcb0/0xcb0 [ 396.953222] ? add_lock_to_list.isra.0+0x450/0x450 [ 396.958186] ? filemap_write_and_wait_range+0xd0/0xd0 [ 396.963397] ? aa_file_perm+0x42e/0x1090 [ 396.967482] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 396.973045] ? lock_downgrade+0x910/0x910 [ 396.977211] ? kasan_check_read+0x11/0x20 [ 396.981380] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 396.986693] ? rcu_read_unlock_special+0x380/0x380 [ 396.991665] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 396.996447] ? lockdep_hardirqs_on+0x415/0x5d0 [ 397.001364] ? retint_kernel+0x2d/0x2d 01:48:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) [ 397.005307] ? trace_hardirqs_on_caller+0xc0/0x310 [ 397.010249] ? aa_file_perm+0x455/0x1090 [ 397.014331] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.019125] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.024617] ? add_lock_to_list.isra.0+0x450/0x450 [ 397.029575] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.034732] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.039519] ? retint_kernel+0x2d/0x2d [ 397.043438] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 397.049002] ? fsnotify+0x4f5/0xed0 [ 397.052649] ? __fsnotify_parent+0x9f/0x450 [ 397.052672] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 397.052692] blkdev_read_iter+0x120/0x190 [ 397.052713] do_iter_readv_writev+0x799/0xbc0 [ 397.052734] ? vfs_dedupe_file_range+0x780/0x780 [ 397.062625] ? rw_verify_area+0x118/0x360 [ 397.062646] do_iter_read+0x27c/0x660 [ 397.062663] ? dup_iter+0x260/0x260 [ 397.062685] vfs_readv+0x175/0x1c0 [ 397.062706] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 397.062720] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.062738] ? kasan_check_write+0x14/0x20 [ 397.062755] ? __mutex_unlock_slowpath+0x195/0x870 [ 397.062774] ? __fget_light+0x2db/0x420 [ 397.115321] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.120094] ? fget_raw+0x20/0x20 [ 397.123561] ? retint_kernel+0x2d/0x2d [ 397.127494] do_preadv+0x1c4/0x280 [ 397.131051] ? do_readv+0x300/0x300 [ 397.135229] ? __ia32_sys_read+0xb0/0xb0 [ 397.139307] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 397.144687] ? trace_hardirqs_off_caller+0x300/0x300 [ 397.149807] __x64_sys_preadv+0x9a/0xf0 [ 397.153801] do_syscall_64+0x1a3/0x800 [ 397.157706] ? syscall_return_slowpath+0x5f0/0x5f0 [ 397.162649] ? prepare_exit_to_usermode+0x232/0x3b0 [ 397.167683] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 397.172545] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 397.177805] RIP: 0033:0x457ec9 [ 397.181010] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 397.199917] RSP: 002b:00007fe95d70ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 01:48:17 executing program 0 (fault-call:5 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 397.207634] RAX: ffffffffffffffda RBX: 00007fe95d70ec90 RCX: 0000000000457ec9 [ 397.214907] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000005 [ 397.222183] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 397.229461] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe95d70f6d4 [ 397.236825] R13: 00000000004c4861 R14: 00000000004d7d20 R15: 0000000000000006 [ 397.254697] CPU: 0 PID: 15549 Comm: syz-executor1 Not tainted 5.0.0-rc1+ #15 [ 397.261924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 397.271284] Call Trace: [ 397.273891] dump_stack+0x1db/0x2d0 [ 397.277552] ? dump_stack_print_info.cold+0x20/0x20 [ 397.282639] ? retint_kernel+0x2d/0x2d [ 397.286550] ? trace_hardirqs_on_caller+0xc0/0x310 [ 397.291523] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.296304] should_fail.cold+0xa/0x15 [ 397.300219] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 397.305344] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.310140] __should_failslab+0x121/0x190 [ 397.314398] should_failslab+0x9/0x14 [ 397.318217] kmem_cache_alloc+0x47/0x710 [ 397.322292] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.327764] mempool_alloc_slab+0x47/0x60 [ 397.331932] mempool_alloc+0x19f/0x500 [ 397.331958] ? mempool_destroy+0x40/0x40 [ 397.331975] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.331994] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.339951] ? iov_iter_alignment+0x189/0xcf0 [ 397.339968] ? iov_iter_alignment+0x1b2/0xcf0 [ 397.339996] bio_alloc_bioset+0x3c1/0x720 [ 397.340015] ? retint_kernel+0x2d/0x2d [ 397.367655] ? bvec_alloc+0x2f0/0x2f0 [ 397.371481] blkdev_direct_IO+0x371/0x13f0 [ 397.371504] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.381201] ? bdev_evict_inode+0x870/0x870 [ 397.381223] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 397.381238] ? touch_atime+0x108/0x320 [ 397.381256] ? atime_needs_update+0x710/0x710 [ 397.399511] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 397.405065] ? filemap_check_errors+0xd8/0x110 [ 397.409690] generic_file_read_iter+0x3d9/0x2d40 [ 397.414465] ? print_usage_bug+0xd0/0xd0 [ 397.418543] ? add_lock_to_list.isra.0+0x450/0x450 [ 397.423524] ? filemap_write_and_wait_range+0xd0/0xd0 [ 397.428732] ? aa_file_perm+0x42e/0x1090 [ 397.432822] ? lock_downgrade+0x910/0x910 [ 397.437002] ? rcu_read_unlock_special+0x380/0x380 [ 397.441956] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.446732] ? lockdep_hardirqs_on+0x415/0x5d0 [ 397.451332] ? retint_kernel+0x2d/0x2d [ 397.455235] ? trace_hardirqs_on_caller+0xc0/0x310 [ 397.460179] ? aa_file_perm+0x455/0x1090 [ 397.464257] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.469033] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.473806] ? lockdep_hardirqs_on+0x415/0x5d0 [ 397.478403] ? retint_kernel+0x2d/0x2d [ 397.482304] ? trace_hardirqs_on_caller+0xc0/0x310 [ 397.487247] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.492017] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.497493] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 397.502493] ? retint_kernel+0x2d/0x2d [ 397.506411] blkdev_read_iter+0x120/0x190 [ 397.510606] do_iter_readv_writev+0x799/0xbc0 [ 397.515132] ? vfs_dedupe_file_range+0x780/0x780 [ 397.519912] ? rw_verify_area+0x118/0x360 [ 397.524085] do_iter_read+0x27c/0x660 [ 397.527897] ? dup_iter+0x260/0x260 [ 397.531553] vfs_readv+0x175/0x1c0 [ 397.535141] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 397.540529] ? kasan_check_write+0x14/0x20 [ 397.544781] ? __mutex_unlock_slowpath+0x195/0x870 [ 397.549730] ? __fget_light+0x2db/0x420 [ 397.553795] ? fget_raw+0x20/0x20 [ 397.557291] ? trace_hardirqs_on_caller+0xc0/0x310 [ 397.562237] ? check_preemption_disabled+0x48/0x290 [ 397.567271] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 397.572736] ? __sb_end_write+0xd9/0x110 [ 397.572762] do_preadv+0x1c4/0x280 [ 397.572780] ? do_readv+0x300/0x300 [ 397.572795] ? retint_kernel+0x2d/0x2d [ 397.572818] __x64_sys_preadv+0x9a/0xf0 [ 397.584052] ? do_syscall_64+0xbc/0x800 [ 397.591902] do_syscall_64+0x1a3/0x800 [ 397.591923] ? syscall_return_slowpath+0x5f0/0x5f0 [ 397.591941] ? prepare_exit_to_usermode+0x232/0x3b0 [ 397.591962] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 397.599823] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 397.599837] RIP: 0033:0x457ec9 [ 397.599854] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 397.599865] RSP: 002b:00007fbed64ccc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 397.609800] RAX: ffffffffffffffda RBX: 00007fbed64ccc90 RCX: 0000000000457ec9 01:48:17 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x900000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:17 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40106308, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:17 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:17 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x1ffc00}], 0x1, 0x0) [ 397.609810] RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000005 [ 397.609819] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 397.609828] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbed64cd6d4 [ 397.609840] R13: 00000000004c4861 R14: 00000000004d7d20 R15: 0000000000000006 [ 397.713793] binder: 15568:15570 BC_INCREFS_DONE u0000000000000000 no match [ 397.725206] binder: undelivered TRANSACTION_COMPLETE [ 397.730634] binder: 15568:15570 unknown command 0 [ 397.736011] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.746344] binder: 15568:15570 ioctl c0306201 200002c0 returned -22 [ 397.771751] binder_alloc: binder_alloc_mmap_handler: 15568 20001000-20004000 already mapped failed -16 [ 397.792905] binder: BINDER_SET_CONTEXT_MGR already set [ 397.805247] binder: 15568:15570 ioctl 40046207 0 returned -16 01:48:18 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xe00000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 397.820294] binder_alloc: 15568: binder_alloc_buf, no vma [ 397.832880] binder: 15568:15576 transaction failed 29189/-3, size 0-0 line 3035 [ 397.849975] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.864017] binder: send failed reply for transaction 431 to 15568:15570 [ 397.893165] binder: undelivered TRANSACTION_COMPLETE [ 397.913198] binder: undelivered TRANSACTION_ERROR: 29189 01:48:18 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) 01:48:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40106309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:18 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:18 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf00000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3f0002}], 0x1, 0x0) 01:48:18 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x1ffc00}], 0x1, 0x0) 01:48:18 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x1300000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 398.103478] binder: 15587:15588 BC_ACQUIRE_DONE u0000000000000000 no match [ 398.140553] binder: 15587:15588 unknown command 0 [ 398.167119] binder: 15587:15588 ioctl c0306201 200002c0 returned -22 [ 398.205712] binder_alloc: binder_alloc_mmap_handler: 15587 20001000-20004000 already mapped failed -16 01:48:18 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x1f00000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 398.250284] binder: BINDER_SET_CONTEXT_MGR already set [ 398.267171] binder: 15587:15588 ioctl 40046207 0 returned -16 01:48:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc02}], 0x1, 0x0) 01:48:18 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x5421, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:18 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x3f00000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 398.383021] binder_alloc: 15587: binder_alloc_buf, no vma [ 398.399262] binder: send failed reply for transaction 434 to 15587:15588 [ 398.453704] binder: undelivered TRANSACTION_COMPLETE 01:48:18 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x1ffc00}], 0x1, 0x0) [ 398.480990] binder: 15587:15611 transaction failed 29189/-3, size 0-0 line 3035 [ 398.492264] binder: undelivered TRANSACTION_ERROR: 29189 01:48:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40400a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:18 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x4700000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:18 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3f0002}], 0x1, 0x0) [ 398.566341] binder: undelivered TRANSACTION_ERROR: 29189 01:48:18 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc03}], 0x1, 0x0) 01:48:18 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x5450, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 398.689226] binder: 15630:15638 unknown command 1077938688 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x6000000000000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 398.734455] binder: 15630:15638 ioctl c0306201 200002c0 returned -22 [ 398.772810] binder_alloc: binder_alloc_mmap_handler: 15630 20001000-20004000 already mapped failed -16 01:48:19 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3f0002}], 0x1, 0x0) 01:48:19 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc02}], 0x1, 0x0) [ 398.826891] binder: BINDER_SET_CONTEXT_MGR already set 01:48:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc04}], 0x1, 0x0) [ 398.859655] binder: 15630:15638 ioctl 40046207 0 returned -16 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x8dffffff00000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 398.904332] binder_alloc: 15630: binder_alloc_buf, no vma [ 398.926955] binder: 15630:15660 transaction failed 29189/-3, size 0-0 line 3035 01:48:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x5451, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 398.953473] binder: send failed reply for transaction 437 to 15630:15638 [ 398.993073] binder: undelivered TRANSACTION_COMPLETE 01:48:19 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc03}], 0x1, 0x0) [ 399.019182] binder: undelivered TRANSACTION_ERROR: 29189 [ 399.043075] binder: undelivered TRANSACTION_ERROR: 29189 01:48:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40402500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xf5ffffff00000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc05}], 0x1, 0x0) 01:48:19 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc04}], 0x1, 0x0) 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xffffffff00000000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 399.215515] binder: 15684:15686 unknown command 1077945600 [ 399.246496] binder: 15684:15686 ioctl c0306201 200002c0 returned -22 01:48:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x5452, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 399.306214] binder_alloc: binder_alloc_mmap_handler: 15684 20001000-20004000 already mapped failed -16 [ 399.359154] binder: BINDER_SET_CONTEXT_MGR already set [ 399.374289] binder: 15684:15686 ioctl 40046207 0 returned -16 [ 399.395849] binder_alloc: 15684: binder_alloc_buf, no vma [ 399.415435] binder: 15684:15702 transaction failed 29189/-3, size 0-0 line 3035 [ 399.442709] binder: send failed reply for transaction 440 to 15684:15686 [ 399.458881] binder: undelivered TRANSACTION_COMPLETE 01:48:19 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc02}], 0x1, 0x0) 01:48:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc06}], 0x1, 0x0) 01:48:19 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc05}], 0x1, 0x0) 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xfffffffffffff000, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 399.565219] binder: 15711:15714 got reply transaction with bad transaction stack, transaction 443 has target 15711:0 01:48:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x5460, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0xffffffffffffffff, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 399.622782] binder: 15711:15714 transaction failed 29201/-71, size 0-0 line 2816 [ 399.647340] binder_alloc: binder_alloc_mmap_handler: 15711 20001000-20004000 already mapped failed -16 01:48:19 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc06}], 0x1, 0x0) [ 399.690280] binder: BINDER_SET_CONTEXT_MGR already set 01:48:19 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x9500, [0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:19 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc07}], 0x1, 0x0) 01:48:20 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc03}], 0x1, 0x0) [ 399.835648] binder: 15711:15714 ioctl 40046207 0 returned -16 [ 399.835688] binder: send failed reply for transaction 443 to 15711:15714 [ 399.874394] binder: undelivered TRANSACTION_COMPLETE 01:48:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:20 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc07}], 0x1, 0x0) 01:48:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc08}], 0x1, 0x0) 01:48:20 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x2, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xae03, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 399.944207] syz-executor3 (15740) used greatest stack depth: 17752 bytes left 01:48:20 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc04}], 0x1, 0x0) [ 400.086520] binder: 15757:15762 unknown command 1077961474 01:48:20 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x3, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:20 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc08}], 0x1, 0x0) [ 400.145631] binder: 15757:15762 ioctl c0306201 200002c0 returned -22 [ 400.176486] binder_alloc: binder_alloc_mmap_handler: 15757 20001000-20004000 already mapped failed -16 01:48:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc09}], 0x1, 0x0) [ 400.247170] binder: BINDER_SET_CONTEXT_MGR already set 01:48:20 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc05}], 0x1, 0x0) [ 400.275740] binder: 15757:15762 ioctl 40046207 0 returned -16 [ 400.309397] binder_alloc: 15757: binder_alloc_buf, no vma 01:48:20 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x4, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xae41, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 400.365348] binder: release 15757:15762 transaction 446 out, still active [ 400.374349] binder: 15757:15778 transaction failed 29189/-3, size 0-0 line 3035 [ 400.392063] binder: undelivered TRANSACTION_COMPLETE [ 400.414012] binder: send failed reply for transaction 446, target dead 01:48:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:20 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc09}], 0x1, 0x0) 01:48:20 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc06}], 0x1, 0x0) 01:48:20 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x5, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:20 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0d}], 0x1, 0x0) 01:48:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x40049409, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 400.624348] binder: 15805:15806 unknown command 1077961475 [ 400.660225] binder: 15805:15806 ioctl c0306201 200002c0 returned -22 01:48:20 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x6, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:20 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc07}], 0x1, 0x0) [ 400.706381] binder_alloc: binder_alloc_mmap_handler: 15805 20001000-20004000 already mapped failed -16 01:48:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc10}], 0x1, 0x0) 01:48:21 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0a}], 0x1, 0x0) [ 400.805415] binder: BINDER_SET_CONTEXT_MGR already set 01:48:21 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc08}], 0x1, 0x0) [ 400.863082] binder: 15805:15806 ioctl 40046207 0 returned -16 [ 400.899812] binder_alloc: 15805: binder_alloc_buf, no vma 01:48:21 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x7, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 400.939121] binder: 15805:15834 transaction failed 29189/-3, size 0-0 line 3035 [ 400.994498] binder: 15805:15806 unknown command 1077961475 [ 401.055678] binder: release 15805:15806 transaction 449 out, still active [ 401.063332] binder: 15805:15806 ioctl c0306201 200002c0 returned -22 [ 401.078763] binder: undelivered TRANSACTION_COMPLETE [ 401.083984] binder: send failed reply for transaction 449, target dead 01:48:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:21 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4008ae61, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc21}], 0x1, 0x0) 01:48:21 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x8, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:21 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0b}], 0x1, 0x0) [ 401.132546] binder_release_work: 5 callbacks suppressed [ 401.132553] binder: undelivered TRANSACTION_ERROR: 29189 01:48:21 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc09}], 0x1, 0x0) 01:48:21 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x9, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 401.275429] binder: 15857:15859 unknown command 1077961476 01:48:21 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc22}], 0x1, 0x0) [ 401.327459] binder: 15857:15859 ioctl c0306201 200002c0 returned -22 [ 401.341447] binder_alloc: binder_alloc_mmap_handler: 15857 20001000-20004000 already mapped failed -16 01:48:21 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0c}], 0x1, 0x0) 01:48:21 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0a}], 0x1, 0x0) [ 401.398920] binder: BINDER_SET_CONTEXT_MGR already set 01:48:21 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xe, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:21 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4008ae6a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 401.458162] binder: 15857:15859 ioctl 40046207 0 returned -16 [ 401.491528] binder_alloc: 15857: binder_alloc_buf, no vma [ 401.497184] binder: 15857:15883 transaction failed 29189/-3, size 0-0 line 3035 [ 401.538982] binder: send failed reply for transaction 452 to 15857:15859 [ 401.577853] binder: undelivered TRANSACTION_COMPLETE [ 401.606077] binder: undelivered TRANSACTION_ERROR: 29189 01:48:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406305, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:22 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0d}], 0x1, 0x0) 01:48:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc23}], 0x1, 0x0) 01:48:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:22 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0b}], 0x1, 0x0) 01:48:22 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4010ae42, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 401.737077] binder: undelivered TRANSACTION_ERROR: 29189 01:48:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x13, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:22 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0c}], 0x1, 0x0) [ 401.902154] binder: 15911:15912 unknown command 1077961477 [ 401.938697] binder: 15911:15912 ioctl c0306201 200002c0 returned -22 01:48:22 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0e}], 0x1, 0x0) 01:48:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x47, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 402.000460] binder_alloc: binder_alloc_mmap_handler: 15911 20001000-20004000 already mapped failed -16 01:48:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc24}], 0x1, 0x0) 01:48:22 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4010ae67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 402.095999] binder: BINDER_SET_CONTEXT_MGR already set [ 402.143635] binder: 15911:15912 ioctl 40046207 0 returned -16 [ 402.181116] binder_alloc: 15911: binder_alloc_buf, no vma [ 402.208750] binder: 15911:15938 transaction failed 29189/-3, size 0-0 line 3035 [ 402.225517] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.248650] binder: send failed reply for transaction 455 to 15911:15912 [ 402.255644] binder: undelivered TRANSACTION_COMPLETE 01:48:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406306, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x60, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:22 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0d}], 0x1, 0x0) 01:48:22 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0f}], 0x1, 0x0) 01:48:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc25}], 0x1, 0x0) [ 402.296006] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.399972] binder: 15952:15953 unknown command 1077961478 01:48:22 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4010ae68, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf0, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 402.442725] binder: 15952:15953 ioctl c0306201 200002c0 returned -22 01:48:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc26}], 0x1, 0x0) 01:48:22 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc10}], 0x1, 0x0) [ 402.495884] binder_alloc: binder_alloc_mmap_handler: 15952 20001000-20004000 already mapped failed -16 01:48:22 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x300, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:22 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0e}], 0x1, 0x0) [ 402.547909] binder: BINDER_SET_CONTEXT_MGR already set [ 402.567769] binder: 15952:15953 ioctl 40046207 0 returned -16 [ 402.639722] binder_alloc: 15952: binder_alloc_buf, no vma 01:48:22 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc27}], 0x1, 0x0) [ 402.695386] binder: send failed reply for transaction 458 to 15952:15953 [ 402.717409] binder: 15952:15975 transaction failed 29189/-3, size 0-0 line 3035 [ 402.725297] binder: undelivered TRANSACTION_COMPLETE [ 402.743625] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.807496] binder: undelivered TRANSACTION_ERROR: 29189 01:48:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:23 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc11}], 0x1, 0x0) 01:48:23 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc0f}], 0x1, 0x0) 01:48:23 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020940d, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x500, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc28}], 0x1, 0x0) 01:48:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x600, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:23 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc12}], 0x1, 0x0) [ 403.014834] binder: 16004:16008 unknown command 1077961479 01:48:23 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc10}], 0x1, 0x0) [ 403.094265] binder: 16004:16008 ioctl c0306201 200002c0 returned -22 01:48:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc29}], 0x1, 0x0) [ 403.139863] binder_alloc: binder_alloc_mmap_handler: 16004 20001000-20004000 already mapped failed -16 01:48:23 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 403.232874] binder: BINDER_SET_CONTEXT_MGR already set 01:48:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x700, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 403.271060] binder: 16004:16008 ioctl 40046207 0 returned -16 [ 403.271092] binder_alloc: 16004: binder_alloc_buf, no vma [ 403.348304] binder: release 16004:16008 transaction 461 out, still active [ 403.377024] binder: 16004:16020 transaction failed 29189/-3, size 0-0 line 3035 [ 403.381015] binder: undelivered TRANSACTION_COMPLETE 01:48:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x4040630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:23 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc13}], 0x1, 0x0) 01:48:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2a}], 0x1, 0x0) 01:48:23 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc11}], 0x1, 0x0) 01:48:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x900, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 403.437579] binder: undelivered TRANSACTION_ERROR: 29189 [ 403.455859] binder: send failed reply for transaction 461, target dead 01:48:23 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2b}], 0x1, 0x0) 01:48:23 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xe00, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 403.556828] binder: 16054:16056 unknown command 1077961482 01:48:23 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae76, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 403.606125] binder: 16054:16056 ioctl c0306201 200002c0 returned -22 01:48:23 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc14}], 0x1, 0x0) [ 403.649255] binder_alloc: binder_alloc_mmap_handler: 16054 20001000-20004000 already mapped failed -16 01:48:23 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc12}], 0x1, 0x0) [ 403.710666] binder: BINDER_SET_CONTEXT_MGR already set 01:48:24 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf00, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 403.770501] binder: 16054:16056 ioctl 40046207 0 returned -16 [ 403.803749] binder_alloc: 16054: binder_alloc_buf, no vma 01:48:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2c}], 0x1, 0x0) [ 403.864070] binder: send failed reply for transaction 464 to 16054:16056 [ 403.881670] binder: undelivered TRANSACTION_COMPLETE [ 403.895367] binder: undelivered TRANSACTION_ERROR: 29189 [ 403.938367] binder: 16054:16079 transaction failed 29189/-3, size 0-0 line 3035 01:48:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:24 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc13}], 0x1, 0x0) 01:48:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020aea5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:24 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x1300, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2d}], 0x1, 0x0) [ 403.993887] binder: undelivered TRANSACTION_ERROR: 29189 01:48:24 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc15}], 0x1, 0x0) 01:48:24 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x1f00, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 404.125697] binder: 16100:16102 unknown command 1077961490 [ 404.161152] binder: 16100:16102 ioctl c0306201 200002c0 returned -22 [ 404.208131] binder_alloc: binder_alloc_mmap_handler: 16100 20001000-20004000 already mapped failed -16 01:48:24 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc14}], 0x1, 0x0) [ 404.253206] binder: BINDER_SET_CONTEXT_MGR already set 01:48:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3e}], 0x1, 0x0) [ 404.277042] binder: 16100:16102 ioctl 40046207 0 returned -16 01:48:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:24 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc16}], 0x1, 0x0) 01:48:24 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x3f00, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 404.399086] binder_alloc: 16100: binder_alloc_buf, no vma [ 404.404740] binder: 16100:16120 transaction failed 29189/-3, size 0-0 line 3035 [ 404.417205] binder: send failed reply for transaction 467 to 16100:16102 [ 404.464614] binder: undelivered TRANSACTION_COMPLETE 01:48:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406348, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:24 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc15}], 0x1, 0x0) 01:48:24 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc17}], 0x1, 0x0) 01:48:24 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x4700, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:24 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3fff00}], 0x1, 0x0) 01:48:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4068aea3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 404.685895] binder: 16146:16147 unknown command 1077961544 [ 404.753090] binder: 16146:16147 ioctl c0306201 200002c0 returned -22 01:48:25 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x6000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 404.819429] binder_alloc: binder_alloc_mmap_handler: 16146 20001000-20004000 already mapped failed -16 [ 404.855381] binder: BINDER_SET_CONTEXT_MGR already set 01:48:25 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0045878, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:25 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc18}], 0x1, 0x0) 01:48:25 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x20400000}], 0x1, 0x0) 01:48:25 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc16}], 0x1, 0x0) [ 404.864291] binder: 16146:16147 ioctl 40046207 0 returned -16 01:48:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x4040634c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:25 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 404.985373] binder: send failed reply for transaction 470 to 16146:16147 [ 405.012197] binder: undelivered TRANSACTION_COMPLETE 01:48:25 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc17}], 0x1, 0x0) [ 405.112441] binder: 16183:16185 unknown command 1077961548 [ 405.147804] binder: 16183:16185 ioctl c0306201 200002c0 returned -22 01:48:25 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0045878, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:25 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc19}], 0x1, 0x0) [ 405.209540] binder_alloc: binder_alloc_mmap_handler: 16183 20001000-20004000 already mapped failed -16 01:48:25 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x40000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 405.305705] binder: BINDER_SET_CONTEXT_MGR already set [ 405.321976] binder: 16183:16185 ioctl 40046207 0 returned -16 [ 405.400059] binder_alloc: 16183: binder_alloc_buf, no vma 01:48:25 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1a}], 0x1, 0x0) [ 405.450248] binder: send failed reply for transaction 472 to 16183:16185 [ 405.458946] binder: 16183:16205 transaction failed 29189/-3, size 0-0 line 3035 01:48:25 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc18}], 0x1, 0x0) [ 405.495128] binder: undelivered TRANSACTION_COMPLETE 01:48:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406360, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:25 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf0ffff, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 405.706460] binder: 16214:16221 unknown command 1077961568 [ 405.756973] binder: 16214:16221 ioctl c0306201 200002c0 returned -22 [ 405.798188] binder_alloc: binder_alloc_mmap_handler: 16214 20001000-20004000 already mapped failed -16 [ 405.815608] binder: BINDER_SET_CONTEXT_MGR already set [ 405.837839] binder: 16214:16221 ioctl 40046207 0 returned -16 [ 405.875300] binder: 16214:16227 unknown command 1077961568 [ 405.878073] binder: release 16214:16221 transaction 475 out, still active [ 405.888018] binder: undelivered TRANSACTION_COMPLETE [ 405.898712] binder: 16214:16227 ioctl c0306201 200002c0 returned -22 [ 405.921763] binder: send failed reply for transaction 475, target dead 01:48:26 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x7ffff000}], 0x1, 0x0) 01:48:26 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc008ae67, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:26 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1b}], 0x1, 0x0) 01:48:26 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x1000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:26 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc19}], 0x1, 0x0) 01:48:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406368, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:26 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x2000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:26 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1c}], 0x1, 0x0) [ 406.148639] binder: 16238:16240 unknown command 1077961576 [ 406.177186] binder: 16238:16240 ioctl c0306201 200002c0 returned -22 [ 406.256720] binder: BINDER_SET_CONTEXT_MGR already set [ 406.279823] binder_alloc: binder_alloc_mmap_handler: 16238 20001000-20004000 already mapped failed -16 01:48:26 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1a}], 0x1, 0x0) [ 406.324917] binder_alloc: 16238: binder_alloc_buf, no vma [ 406.351804] binder: 16238:16240 ioctl 40046207 0 returned -16 01:48:26 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x3000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 406.378639] binder: 16238:16254 transaction failed 29189/-3, size 0-0 line 3035 01:48:26 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc00caee0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 406.423986] binder: release 16238:16240 transaction 477 out, still active 01:48:26 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1d}], 0x1, 0x0) [ 406.488796] binder: undelivered TRANSACTION_COMPLETE [ 406.493998] binder_release_work: 5 callbacks suppressed [ 406.494004] binder: undelivered TRANSACTION_ERROR: 29189 [ 406.565030] binder: send failed reply for transaction 477, target dead 01:48:27 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3e80000000}], 0x1, 0x0) 01:48:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x4040636c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:27 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x4000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:27 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1e}], 0x1, 0x0) 01:48:27 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1b}], 0x1, 0x0) 01:48:27 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0189436, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 407.180992] binder: 16290:16291 unknown command 1077961580 01:48:27 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1c}], 0x1, 0x0) 01:48:27 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x5000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:27 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc21}], 0x1, 0x0) [ 407.243502] binder: 16290:16291 ioctl c0306201 200002c0 returned -22 01:48:27 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc020660b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 407.322622] binder_alloc: binder_alloc_mmap_handler: 16290 20001000-20004000 already mapped failed -16 01:48:27 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x6000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 407.391810] binder: BINDER_SET_CONTEXT_MGR already set [ 407.428031] binder: 16290:16291 ioctl 40046207 0 returned -16 01:48:27 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1d}], 0x1, 0x0) [ 407.475361] binder_alloc: 16290: binder_alloc_buf, no vma [ 407.523786] binder: release 16290:16291 transaction 480 out, still active [ 407.532015] binder: 16290:16318 transaction failed 29189/-3, size 0-0 line 3035 [ 407.563643] binder: undelivered TRANSACTION_COMPLETE [ 407.600964] binder: send failed reply for transaction 480, target dead [ 407.647823] binder: undelivered TRANSACTION_ERROR: 29189 01:48:28 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x2, 0x0) 01:48:28 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc22}], 0x1, 0x0) 01:48:28 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x7000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:28 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x2, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406374, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:28 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc1e}], 0x1, 0x0) 01:48:28 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x8000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 408.364955] binder: 16338:16340 unknown command 1077961588 [ 408.388877] binder: 16338:16340 ioctl c0306201 200002c0 returned -22 01:48:28 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc21}], 0x1, 0x0) 01:48:28 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc23}], 0x1, 0x0) [ 408.432648] binder_alloc: binder_alloc_mmap_handler: 16338 20001000-20004000 already mapped failed -16 [ 408.457258] binder: BINDER_SET_CONTEXT_MGR already set 01:48:28 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x9000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 408.503721] binder: 16338:16340 ioctl 40046207 0 returned -16 [ 408.560815] binder: 16338:16350 unknown command 1077961588 01:48:28 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc22}], 0x1, 0x0) [ 408.605640] binder: 16338:16350 ioctl c0306201 200002c0 returned -22 [ 408.611388] binder: send failed reply for transaction 483 to 16338:16340 [ 408.623525] binder: undelivered TRANSACTION_COMPLETE 01:48:28 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x1fc, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 408.647380] binder: undelivered TRANSACTION_ERROR: 29189 01:48:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x3, 0x0) 01:48:29 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xe000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:29 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc24}], 0x1, 0x0) 01:48:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x4040637a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:29 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc23}], 0x1, 0x0) 01:48:29 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x4000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 409.048940] binder: 16385:16387 unknown command 1077961594 [ 409.069815] binder: 16385:16387 ioctl c0306201 200002c0 returned -22 01:48:29 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 409.097866] binder_alloc: binder_alloc_mmap_handler: 16385 20001000-20004000 already mapped failed -16 [ 409.147975] binder: BINDER_SET_CONTEXT_MGR already set 01:48:29 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc25}], 0x1, 0x0) 01:48:29 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc24}], 0x1, 0x0) 01:48:29 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xfc01, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 409.168671] binder: 16385:16387 ioctl 40046207 0 returned -16 [ 409.194964] binder_alloc: 16385: binder_alloc_buf, no vma 01:48:29 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x4, 0x0) 01:48:29 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x13000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 409.270738] binder: 16385:16405 transaction failed 29189/-3, size 0-0 line 3035 [ 409.286273] binder: send failed reply for transaction 485 to 16385:16387 [ 409.323225] binder: undelivered TRANSACTION_ERROR: 29189 [ 409.351138] binder: undelivered TRANSACTION_COMPLETE 01:48:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40407600, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 409.370429] binder: undelivered TRANSACTION_ERROR: 29189 01:48:29 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc26}], 0x1, 0x0) 01:48:29 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc25}], 0x1, 0x0) [ 409.453872] binder: 16427:16428 unknown command 1077966336 01:48:29 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x1f000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 409.516272] binder: 16427:16428 ioctl c0306201 200002c0 returned -22 01:48:29 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x80ffff, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 409.564085] binder_alloc: binder_alloc_mmap_handler: 16427 20001000-20004000 already mapped failed -16 01:48:29 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc27}], 0x1, 0x0) [ 409.664706] binder: BINDER_SET_CONTEXT_MGR already set 01:48:29 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc26}], 0x1, 0x0) [ 409.694934] binder: 16427:16428 ioctl 40046207 0 returned -16 [ 409.721669] binder_alloc: 16427: binder_alloc_buf, no vma [ 409.727317] binder: 16427:16445 transaction failed 29189/-3, size 0-0 line 3035 01:48:30 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x3f000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 409.793727] binder: undelivered TRANSACTION_ERROR: 29189 01:48:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 409.858697] binder: send failed reply for transaction 488 to 16427:16428 [ 409.869201] binder: undelivered TRANSACTION_COMPLETE [ 409.874323] binder: undelivered TRANSACTION_ERROR: 29189 01:48:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x8, 0x0) 01:48:30 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc28}], 0x1, 0x0) 01:48:30 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x1000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 410.006752] binder: 16461:16462 got new transaction with bad transaction stack, transaction 491 has target 16461:0 01:48:30 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x47000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:30 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc27}], 0x1, 0x0) [ 410.113455] binder: 16461:16462 transaction failed 29201/-71, size 0-0 line 2946 01:48:30 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc29}], 0x1, 0x0) [ 410.173629] binder_alloc: binder_alloc_mmap_handler: 16461 20001000-20004000 already mapped failed -16 [ 410.209620] binder: BINDER_SET_CONTEXT_MGR already set 01:48:30 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc28}], 0x1, 0x0) 01:48:30 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x60000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 410.254896] binder: 16461:16482 ioctl 40046207 0 returned -16 [ 410.274289] binder: release 16461:16462 transaction 491 out, still active [ 410.281625] binder_alloc: 16461: binder_alloc_buf, no vma 01:48:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xf, 0x0) [ 410.298743] binder: 16461:16483 transaction failed 29189/-3, size 0-0 line 3035 [ 410.324151] binder: undelivered TRANSACTION_COMPLETE [ 410.363195] binder: undelivered TRANSACTION_ERROR: 29201 01:48:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:30 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x8dffffff, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:30 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc29}], 0x1, 0x0) 01:48:30 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2a}], 0x1, 0x0) [ 410.405917] binder: undelivered TRANSACTION_ERROR: 29189 [ 410.440419] binder: send failed reply for transaction 491, target dead 01:48:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x10, 0x0) 01:48:30 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x2000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 410.539416] binder: 16505:16506 got reply transaction with bad transaction stack, transaction 495 has target 16505:0 01:48:30 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf5ffffff, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:30 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2b}], 0x1, 0x0) [ 410.638664] binder: 16505:16506 transaction failed 29201/-71, size 0-0 line 2816 01:48:30 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x500, 0x0) 01:48:30 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2a}], 0x1, 0x0) [ 410.736812] binder_alloc: binder_alloc_mmap_handler: 16505 20001000-20004000 already mapped failed -16 01:48:31 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xfffff000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:31 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2c}], 0x1, 0x0) [ 410.869238] binder: BINDER_SET_CONTEXT_MGR already set [ 410.944572] binder: 16505:16542 ioctl 40046207 0 returned -16 [ 410.944619] binder_alloc: 16505: binder_alloc_buf, no vma [ 410.954347] binder: release 16505:16506 transaction 495 out, still active [ 411.005115] binder: undelivered TRANSACTION_COMPLETE [ 411.020289] binder: 16505:16530 transaction failed 29189/-3, size 0-0 line 3035 [ 411.030208] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.041139] binder: send failed reply for transaction 495, target dead 01:48:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x40000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:31 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2b}], 0x1, 0x0) 01:48:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xff00, 0x0) 01:48:31 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xffffff8d, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:31 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2d}], 0x1, 0x0) 01:48:31 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xfffffff5, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:31 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2c}], 0x1, 0x0) [ 411.196642] binder: 16569:16570 got transaction to invalid handle 01:48:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xffff8880a32f4d68, 0x0) 01:48:31 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2e}], 0x1, 0x0) [ 411.286974] binder: 16569:16570 transaction failed 29201/-22, size 0-0 line 2896 01:48:31 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xfc010000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 411.347797] binder_alloc: binder_alloc_mmap_handler: 16569 20001000-20004000 already mapped failed -16 [ 411.393360] binder: BINDER_SET_CONTEXT_MGR already set 01:48:31 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x4000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 411.447112] binder: 16569:16570 ioctl 40046207 0 returned -16 [ 411.495772] binder_alloc: 16569: binder_alloc_buf, no vma [ 411.519901] binder: 16569:16597 transaction failed 29189/-3, size 0-0 line 3035 [ 411.564236] binder: release 16569:16570 transaction 499 out, still active [ 411.568773] binder: 16569:16570 got transaction to invalid handle [ 411.575771] binder: undelivered TRANSACTION_COMPLETE [ 411.601706] binder_release_work: 1 callbacks suppressed [ 411.601713] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.621440] binder: 16569:16570 transaction failed 29201/-22, size 0-0 line 2896 [ 411.651819] binder: send failed reply for transaction 499, target dead 01:48:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:31 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2d}], 0x1, 0x0) 01:48:31 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0xffff8880a32f4f28, 0x0) 01:48:31 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2f}], 0x1, 0x0) 01:48:31 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf0ffffffffffff, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 411.670017] binder: undelivered TRANSACTION_ERROR: 29201 [ 411.675652] binder: undelivered TRANSACTION_ERROR: 29189 01:48:32 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xfdfdffff, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x2) 01:48:32 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x100000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 411.767430] binder: 16613:16616 got transaction to invalid handle [ 411.817699] binder: 16613:16616 transaction failed 29201/-22, size 0-0 line 2896 01:48:32 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc30}], 0x1, 0x0) [ 411.892421] binder_alloc: binder_alloc_mmap_handler: 16613 20001000-20004000 already mapped failed -16 01:48:32 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2e}], 0x1, 0x0) [ 411.941877] binder: BINDER_SET_CONTEXT_MGR already set 01:48:32 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x200000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 411.991027] binder: 16613:16616 ioctl 40046207 0 returned -16 [ 412.027417] binder_alloc: 16613: binder_alloc_buf, no vma 01:48:32 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xffff8000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 412.063451] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.132884] binder: send failed reply for transaction 504 to 16613:16616 [ 412.153278] binder: undelivered TRANSACTION_COMPLETE [ 412.158414] binder: undelivered TRANSACTION_ERROR: 29201 01:48:32 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x300000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x3) 01:48:32 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc31}], 0x1, 0x0) [ 412.189747] binder: undelivered TRANSACTION_ERROR: 29189 01:48:32 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc2f}], 0x1, 0x0) 01:48:32 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc32}], 0x1, 0x0) 01:48:32 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xfffffdfd, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 412.320959] binder: undelivered TRANSACTION_ERROR: 29189 01:48:32 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x400000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x4) 01:48:32 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc30}], 0x1, 0x0) [ 412.510809] binder: 16684:16685 got transaction to invalid handle 01:48:32 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc33}], 0x1, 0x0) 01:48:32 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x500000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:32 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x80ffff00000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 412.618040] binder_alloc: binder_alloc_mmap_handler: 16684 20001000-20004000 already mapped failed -16 [ 412.673848] binder: BINDER_SET_CONTEXT_MGR already set 01:48:32 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x5) 01:48:32 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc31}], 0x1, 0x0) [ 412.708796] binder: 16684:16685 ioctl 40046207 0 returned -16 [ 412.718702] binder_alloc: 16684: binder_alloc_buf, no vma [ 412.720708] binder: send failed reply for transaction 509 to 16684:16685 [ 412.773274] binder: undelivered TRANSACTION_COMPLETE [ 412.795834] binder: undelivered TRANSACTION_ERROR: 29201 [ 412.831657] binder: undelivered TRANSACTION_ERROR: 29189 01:48:33 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc34}], 0x1, 0x0) 01:48:33 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x600000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 412.856518] binder: undelivered TRANSACTION_ERROR: 29189 01:48:33 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc32}], 0x1, 0x0) 01:48:33 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x6) 01:48:33 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x100000000000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 413.042655] binder: 16725:16727 got transaction to invalid handle 01:48:33 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x700000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:33 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc35}], 0x1, 0x0) [ 413.083086] binder_alloc: binder_alloc_mmap_handler: 16725 20001000-20004000 already mapped failed -16 [ 413.122255] binder: BINDER_SET_CONTEXT_MGR already set 01:48:33 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc33}], 0x1, 0x0) 01:48:33 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x7) [ 413.207989] binder: 16725:16727 ioctl 40046207 0 returned -16 [ 413.208847] binder_alloc: 16725: binder_alloc_buf, no vma 01:48:33 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x800000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:33 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc36}], 0x1, 0x0) 01:48:33 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x200000000000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:33 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc34}], 0x1, 0x0) [ 413.350238] binder: send failed reply for transaction 513 to 16725:16727 [ 413.357211] binder: undelivered TRANSACTION_COMPLETE 01:48:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:33 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x900000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:33 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x8) [ 413.517167] binder: 16776:16778 got transaction to invalid handle 01:48:33 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc37}], 0x1, 0x0) 01:48:33 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xe00000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 413.568105] binder_alloc: binder_alloc_mmap_handler: 16776 20001000-20004000 already mapped failed -16 [ 413.645016] binder: BINDER_SET_CONTEXT_MGR already set 01:48:33 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc35}], 0x1, 0x0) 01:48:33 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x4000000000000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 413.676299] binder: 16776:16778 ioctl 40046207 0 returned -16 [ 413.749214] binder_alloc: 16776: binder_alloc_buf, no vma 01:48:34 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf00000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:34 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc36}], 0x1, 0x0) [ 413.795232] binder: release 16776:16778 transaction 517 out, still active [ 413.827404] binder: undelivered TRANSACTION_COMPLETE 01:48:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x9) 01:48:34 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc38}], 0x1, 0x0) [ 413.862803] binder: send failed reply for transaction 517, target dead 01:48:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x8000000000000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:34 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x1300000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:34 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc37}], 0x1, 0x0) [ 414.044936] binder: 16818:16820 got transaction to invalid handle 01:48:34 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc39}], 0x1, 0x0) 01:48:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0xd) [ 414.142043] binder_alloc: binder_alloc_mmap_handler: 16818 20001000-20004000 already mapped failed -16 01:48:34 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x1f00000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 414.214039] binder: BINDER_SET_CONTEXT_MGR already set 01:48:34 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3a}], 0x1, 0x0) 01:48:34 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc38}], 0x1, 0x0) [ 414.278613] binder: 16818:16820 ioctl 40046207 0 returned -16 [ 414.317979] binder_alloc: 16818: binder_alloc_buf, no vma 01:48:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x10) 01:48:34 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x3f00000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 414.358615] binder_transaction: 9 callbacks suppressed [ 414.358635] binder: 16818:16844 transaction failed 29189/-3, size 0-0 line 3035 01:48:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xfc01000000000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 414.469126] binder: send failed reply for transaction 521 to 16818:16820 [ 414.515791] binder: undelivered TRANSACTION_COMPLETE 01:48:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:34 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc39}], 0x1, 0x0) 01:48:34 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x1c) 01:48:34 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3b}], 0x1, 0x0) 01:48:34 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x4700000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 414.651406] binder: 16873:16874 got transaction to invalid handle 01:48:34 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3c}], 0x1, 0x0) 01:48:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0xfdfdffff00000000, 0x0, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 414.704745] binder: 16873:16874 transaction failed 29201/-22, size 0-0 line 2896 01:48:35 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3a}], 0x1, 0x0) 01:48:35 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x6000000000000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 414.788651] binder_alloc: binder_alloc_mmap_handler: 16873 20001000-20004000 already mapped failed -16 01:48:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x21) [ 414.869425] binder_alloc: 16873: binder_alloc_buf, no vma [ 414.875045] binder: 16873:16885 transaction failed 29189/-3, size 0-0 line 3035 [ 414.896073] binder: send failed reply for transaction 525 to 16873:16874 01:48:35 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x8dffffff00000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 414.929033] binder: undelivered TRANSACTION_COMPLETE 01:48:35 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3d}], 0x1, 0x0) 01:48:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:35 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3b}], 0x1, 0x0) 01:48:35 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x22) 01:48:35 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3e}], 0x1, 0x0) [ 415.110947] binder: 16916:16917 got transaction to invalid handle [ 415.117276] binder: 16916:16917 transaction failed 29201/-22, size 0-0 line 2896 01:48:35 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xf5ffffff00000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x23) 01:48:35 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3c}], 0x1, 0x0) [ 415.287200] binder_alloc: binder_alloc_mmap_handler: 16916 20001000-20004000 already mapped failed -16 01:48:35 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xffffffff00000000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:35 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x1fc, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 415.442217] binder_alloc: 16916: binder_alloc_buf, no vma 01:48:35 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3d}], 0x1, 0x0) 01:48:35 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc41}], 0x1, 0x0) [ 415.482880] binder: BINDER_SET_CONTEXT_MGR already set [ 415.522943] binder: 16916:16933 transaction failed 29189/-3, size 0-0 line 3035 [ 415.576652] binder: release 16916:16917 transaction 529 out, still active [ 415.586196] binder: 16916:16949 ioctl 40046207 0 returned -16 [ 415.594566] binder: undelivered TRANSACTION_COMPLETE [ 415.617738] binder: send failed reply for transaction 529, target dead 01:48:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000700)=[@transaction={0x40406300, {0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 01:48:35 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xfffffffffffff000, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) 01:48:35 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x24) 01:48:35 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc42}], 0x1, 0x0) 01:48:35 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001880)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto(r1, &(0x7f0000000000)="ab3de75ec5ecbe18204e9e63c644f3947c9ba5149dcc2f398dcd998415dac95d8e3bbbe30c278f4b5f7373e07de273cf35b5c379f9d0960dddf110551c3d08ee8236a46810c4c5dbd4", 0x49, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000001740)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc018aec0, &(0x7f0000000080)={0x0, 0x4000, 0x0, 0x712000, &(0x7f0000001000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:48:35 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc3e}], 0x1, 0x0) [ 415.793531] binder: 16974:16977 got transaction to invalid handle 01:48:36 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0xffffffffffffffff, 0x0, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 415.841364] binder: 16974:16977 transaction failed 29201/-22, size 0-0 line 2896 01:48:36 executing program 1: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc41}], 0x1, 0x0) [ 415.881820] ================================================================== [ 415.890440] BUG: KASAN: slab-out-of-bounds in kvm_clear_dirty_log_protect+0x8cf/0x970 [ 415.898421] Read of size 8 at addr ffff888090794b50 by task syz-executor0/16980 [ 415.905861] [ 415.907499] CPU: 1 PID: 16980 Comm: syz-executor0 Not tainted 5.0.0-rc1+ #15 [ 415.914687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 415.924041] Call Trace: [ 415.926636] dump_stack+0x1db/0x2d0 [ 415.930276] ? dump_stack_print_info.cold+0x20/0x20 [ 415.935315] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 415.940621] print_address_description.cold+0x7c/0x20d [ 415.945910] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 415.951197] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 415.956511] kasan_report.cold+0x1b/0x40 [ 415.960586] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 415.965890] __asan_report_load8_noabort+0x14/0x20 [ 415.970829] kvm_clear_dirty_log_protect+0x8cf/0x970 [ 415.975945] ? vcpu_stat_get_per_vm_open+0x40/0x40 [ 415.980886] ? lock_downgrade+0x910/0x910 [ 415.985042] ? lock_release+0xc40/0xc40 [ 415.989119] kvm_vm_ioctl_clear_dirty_log+0xff/0x260 [ 415.994234] ? kvm_vm_ioctl_get_dirty_log+0x260/0x260 [ 415.999438] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 416.000824] binder_alloc: binder_alloc_mmap_handler: 16974 20001000-20004000 already mapped failed -16 [ 416.004982] ? _copy_from_user+0xdd/0x150 [ 416.018614] kvm_vm_ioctl+0xc19/0x1fe0 [ 416.022518] ? __lock_acquire+0x572/0x4a30 [ 416.026769] ? kasan_check_read+0x11/0x20 01:48:36 executing program 3: syz_emit_ethernet(0x55, &(0x7f0000000140)={@local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, "ca819d", 0x1f, 0xffffff84, 0x0, @dev={0xfe, 0x80, [0x0, 0x2, 0x0, 0x0, 0x900000000000000]}, @local, {[], @icmpv6=@echo_request={0x80, 0x0, 0x0, 0x0, 0x0, "333ad7425b349d8b005f2d45c33c255d6e8818b5f18a9e"}}}}}}, 0x0) [ 416.030931] ? do_raw_spin_unlock+0xa0/0x330 [ 416.035352] ? kvm_unregister_device_ops+0x70/0x70 [ 416.040300] ? mark_held_locks+0x100/0x100 [ 416.044633] ? get_futex_key+0x2050/0x2050 [ 416.048892] ? add_lock_to_list.isra.0+0x450/0x450 [ 416.053833] ? mark_held_locks+0x100/0x100 [ 416.058085] ? __fget+0x472/0x710 [ 416.061555] ? find_held_lock+0x35/0x120 [ 416.064976] binder: BINDER_SET_CONTEXT_MGR already set [ 416.065632] ? __fget+0x472/0x710 [ 416.074366] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 416.079916] ? lock_downgrade+0x910/0x910 [ 416.084077] ? kasan_check_read+0x11/0x20 [ 416.088237] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 416.093527] ? rcu_read_unlock_special+0x380/0x380 [ 416.098475] ? __fget+0x499/0x710 [ 416.101944] ? iterate_fd+0x4b0/0x4b0 [ 416.105751] ? lock_release+0xc40/0xc40 [ 416.106709] binder: 16974:16977 ioctl 40046207 0 returned -16 [ 416.109738] ? kvm_unregister_device_ops+0x70/0x70 [ 416.109811] do_vfs_ioctl+0x107b/0x17d0 [ 416.109833] ? ioctl_preallocate+0x2f0/0x2f0 [ 416.129024] ? __fget_light+0x2db/0x420 01:48:36 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc43}], 0x1, 0x0) [ 416.131374] binder_alloc: 16974: binder_alloc_buf, no vma [ 416.133012] ? fget_raw+0x20/0x20 [ 416.133078] ? put_timespec64+0x115/0x1b0 [ 416.133096] ? nsecs_to_jiffies+0x30/0x30 [ 416.146232] ? do_syscall_64+0x8c/0x800 [ 416.154333] ? do_syscall_64+0x8c/0x800 [ 416.158316] ? lockdep_hardirqs_on+0x415/0x5d0 [ 416.162964] ? security_file_ioctl+0x93/0xc0 [ 416.167391] ksys_ioctl+0xab/0xd0 [ 416.170857] __x64_sys_ioctl+0x73/0xb0 [ 416.174769] do_syscall_64+0x1a3/0x800 [ 416.178679] ? syscall_return_slowpath+0x5f0/0x5f0 [ 416.183626] ? prepare_exit_to_usermode+0x232/0x3b0 [ 416.188659] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 416.193518] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 416.194049] binder: 16974:16993 transaction failed 29189/-3, size 0-0 line 3035 [ 416.198704] RIP: 0033:0x457ec9 [ 416.198722] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 416.198730] RSP: 002b:00007fd492df2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 416.198745] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9 [ 416.198753] RDX: 0000000020000080 RSI: 00000000c018aec0 RDI: 0000000000000005 [ 416.198762] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 416.198771] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd492df36d4 [ 416.198780] R13: 00000000004ca068 R14: 00000000004d2b90 R15: 00000000ffffffff [ 416.198802] [ 416.198809] Allocated by task 16980: [ 416.198825] save_stack+0x45/0xd0 [ 416.198840] kasan_kmalloc+0xcf/0xe0 [ 416.222987] binder: send failed reply for transaction 533 to 16974:16977 [ 416.228375] __kmalloc_node+0x4e/0x70 [ 416.228447] kvmalloc_node+0x68/0x100 [ 416.228467] __kvm_set_memory_region+0x1da1/0x2c40 [ 416.304343] kvm_set_memory_region+0x2f/0x60 [ 416.308749] kvm_vm_ioctl+0xafa/0x1fe0 [ 416.312634] do_vfs_ioctl+0x107b/0x17d0 [ 416.316613] ksys_ioctl+0xab/0xd0 [ 416.320064] __x64_sys_ioctl+0x73/0xb0 [ 416.323950] do_syscall_64+0x1a3/0x800 [ 416.327841] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 416.333018] [ 416.334640] Freed by task 8115: [ 416.337921] save_stack+0x45/0xd0 [ 416.341376] __kasan_slab_free+0x102/0x150 [ 416.345619] kasan_slab_free+0xe/0x10 [ 416.349418] kfree+0xcf/0x230 [ 416.352522] kvfree+0x61/0x70 [ 416.355632] __vunmap+0x2e1/0x400 [ 416.359081] vfree+0x8d/0x140 [ 416.362195] __do_replace+0x805/0xa90 [ 416.365993] do_ip6t_set_ctl+0x4a9/0x659 [ 416.370053] nf_setsockopt+0x7d/0xd0 [ 416.373766] ipv6_setsockopt+0x144/0x170 [ 416.377824] tcp_setsockopt+0x95/0xf0 [ 416.381629] sock_common_setsockopt+0x9a/0xe0 [ 416.386126] __sys_setsockopt+0x1b0/0x3a0 [ 416.390277] __x64_sys_setsockopt+0xbe/0x150 [ 416.394683] do_syscall_64+0x1a3/0x800 [ 416.398569] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 416.403752] [ 416.405377] The buggy address belongs to the object at ffff888090794b40 [ 416.405377] which belongs to the cache kmalloc-32 of size 32 [ 416.417857] The buggy address is located 16 bytes inside of [ 416.417857] 32-byte region [ffff888090794b40, ffff888090794b60) [ 416.429552] The buggy address belongs to the page: [ 416.434478] page:ffffea000241e500 count:1 mapcount:0 mapping:ffff88812c3f01c0 index:0xffff888090794fc1 [ 416.443917] flags: 0x1fffc0000000200(slab) [ 416.448159] raw: 01fffc0000000200 ffffea00024d9c88 ffffea0002a099c8 ffff88812c3f01c0 [ 416.456038] raw: ffff888090794fc1 ffff888090794000 0000000100000035 0000000000000000 [ 416.464122] page dumped because: kasan: bad access detected [ 416.469820] [ 416.471436] Memory state around the buggy address: [ 416.476364] ffff888090794a00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 416.483719] ffff888090794a80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 416.491303] >ffff888090794b00: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc [ 416.498651] ^ [ 416.504628] ffff888090794b80: 00 03 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 416.511981] ffff888090794c00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 416.519328] ================================================================== [ 416.526674] Disabling lock debugging due to kernel taint [ 416.532625] Kernel panic - not syncing: panic_on_warn set ... [ 416.538527] CPU: 1 PID: 16980 Comm: syz-executor0 Tainted: G B 5.0.0-rc1+ #15 [ 416.540638] kobject: 'loop2' (00000000b266a751): kobject_uevent_env [ 416.547106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 416.562834] Call Trace: [ 416.565426] dump_stack+0x1db/0x2d0 [ 416.566161] kobject: 'loop2' (00000000b266a751): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 416.569057] ? dump_stack_print_info.cold+0x20/0x20 [ 416.569080] panic+0x2cb/0x65c [ 416.569096] ? add_taint.cold+0x16/0x16 [ 416.569123] ? trace_hardirqs_on+0xb4/0x310 [ 416.569139] ? trace_hardirqs_on+0xb4/0x310 [ 416.587572] kobject: 'loop3' (00000000ddd3c22e): kobject_uevent_env [ 416.590737] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 416.590755] end_report+0x47/0x4f [ 416.590771] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 416.590789] kasan_report.cold+0xe/0x40 [ 416.601235] kobject: 'loop3' (00000000ddd3c22e): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 416.605820] ? kvm_clear_dirty_log_protect+0x8cf/0x970 [ 416.605845] __asan_report_load8_noabort+0x14/0x20 [ 416.643382] kvm_clear_dirty_log_protect+0x8cf/0x970 [ 416.648499] ? vcpu_stat_get_per_vm_open+0x40/0x40 [ 416.653436] ? lock_downgrade+0x910/0x910 [ 416.656565] binder_release_work: 13 callbacks suppressed [ 416.656571] binder: undelivered TRANSACTION_ERROR: 29189 [ 416.657583] ? lock_release+0xc40/0xc40 [ 416.657616] kvm_vm_ioctl_clear_dirty_log+0xff/0x260 [ 416.657635] ? kvm_vm_ioctl_get_dirty_log+0x260/0x260 [ 416.666145] binder: undelivered TRANSACTION_COMPLETE [ 416.668517] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 416.668532] ? _copy_from_user+0xdd/0x150 [ 416.668548] kvm_vm_ioctl+0xc19/0x1fe0 [ 416.668562] ? __lock_acquire+0x572/0x4a30 [ 416.668580] ? kasan_check_read+0x11/0x20 [ 416.672902] binder: undelivered TRANSACTION_ERROR: 29201 [ 416.677643] ? do_raw_spin_unlock+0xa0/0x330 [ 416.677659] ? kvm_unregister_device_ops+0x70/0x70 [ 416.677677] ? mark_held_locks+0x100/0x100 [ 416.729158] ? get_futex_key+0x2050/0x2050 [ 416.733403] ? add_lock_to_list.isra.0+0x450/0x450 [ 416.738335] ? mark_held_locks+0x100/0x100 [ 416.742574] ? __fget+0x472/0x710 [ 416.746032] ? find_held_lock+0x35/0x120 [ 416.750089] ? __fget+0x472/0x710 [ 416.753549] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 416.759090] ? lock_downgrade+0x910/0x910 [ 416.763245] ? kasan_check_read+0x11/0x20 [ 416.767390] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 416.772666] ? rcu_read_unlock_special+0x380/0x380 [ 416.777606] ? __fget+0x499/0x710 [ 416.781061] ? iterate_fd+0x4b0/0x4b0 [ 416.784857] ? lock_release+0xc40/0xc40 [ 416.788837] ? kvm_unregister_device_ops+0x70/0x70 [ 416.793763] do_vfs_ioctl+0x107b/0x17d0 [ 416.797739] ? ioctl_preallocate+0x2f0/0x2f0 [ 416.802147] ? __fget_light+0x2db/0x420 [ 416.806130] ? fget_raw+0x20/0x20 [ 416.809582] ? put_timespec64+0x115/0x1b0 [ 416.813737] ? nsecs_to_jiffies+0x30/0x30 [ 416.817884] ? do_syscall_64+0x8c/0x800 [ 416.821857] ? do_syscall_64+0x8c/0x800 [ 416.825829] ? lockdep_hardirqs_on+0x415/0x5d0 [ 416.830415] ? security_file_ioctl+0x93/0xc0 [ 416.834823] ksys_ioctl+0xab/0xd0 [ 416.838275] __x64_sys_ioctl+0x73/0xb0 [ 416.842167] do_syscall_64+0x1a3/0x800 [ 416.846054] ? syscall_return_slowpath+0x5f0/0x5f0 [ 416.850988] ? prepare_exit_to_usermode+0x232/0x3b0 [ 416.856008] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 416.860854] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 416.866038] RIP: 0033:0x457ec9 [ 416.869229] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 416.888136] RSP: 002b:00007fd492df2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 416.895847] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9 [ 416.903116] RDX: 0000000020000080 RSI: 00000000c018aec0 RDI: 0000000000000005 [ 416.910379] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 416.917643] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd492df36d4 [ 416.924918] R13: 00000000004ca068 R14: 00000000004d2b90 R15: 00000000ffffffff [ 416.933250] Kernel Offset: disabled [ 416.936920] Rebooting in 86400 seconds..