x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x0, 0xffffffffffffffff}) 06:13:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6800, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3332.647430][ T4453] binder_alloc: 4408: binder_alloc_buf size 100675584 failed, no address space [ 3332.669434][ T4463] binder: BINDER_SET_CONTEXT_MGR already set [ 3332.671139][ T4453] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400f0000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3332.701364][ T4463] binder: 4443:4463 ioctl 40046207 0 returned -16 06:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0x6000000000000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000801ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00', 0x0, 0xffffffffffffffff}) 06:13:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0x6558000000000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3332.966622][ T4863] binder_alloc: 4861: binder_alloc_buf size 117452800 failed, no address space [ 3332.966643][ T4873] binder: BINDER_SET_CONTEXT_MGR already set [ 3333.005941][ T4873] binder: 4871:4873 ioctl 40046207 0 returned -16 06:13:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B\x00', 0x0, 0xffffffffffffffff}) 06:13:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000901ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6c00, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3333.030179][ T4863] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x0, 0xffffffffffffffff}) 06:13:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140002000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0x8100000000000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3333.242973][ T5272] binder: BINDER_SET_CONTEXT_MGR already set [ 3333.254035][ T5272] binder: 5254:5272 ioctl 40046207 0 returned -16 06:13:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x0, 0xffffffffffffffff}) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140003000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140004000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x7400, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x0, 0xffffffffffffffff}) [ 3333.423360][ T5446] binder_alloc: 5445: binder_alloc_buf size 167784448 failed, no address space [ 3333.446912][ T5446] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0x88a8ffff00000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x0, 0xffffffffffffffff}) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140007000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x0, 0xffffffffffffffff}) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000a000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3333.616044][ T5638] binder: BINDER_SET_CONTEXT_MGR already set [ 3333.654125][ T5638] binder: 5625:5638 ioctl 40046207 0 returned -16 06:13:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0x9effffff00000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000e000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x0, 0xffffffffffffffff}) 06:13:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x7a00, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3333.799443][ T5951] binder_alloc: 5930: binder_alloc_buf size 302002176 failed, no address space [ 3333.833791][ T5951] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140060000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xaf58000000000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\x00', 0x0, 0xffffffffffffffff}) [ 3333.960087][ T6059] binder: BINDER_SET_CONTEXT_MGR already set [ 3333.996896][ T6059] binder: 6052:6059 ioctl 40046207 0 returned -16 06:13:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400f0000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3334.141856][ T6438] binder_alloc: 6437: binder_alloc_buf size 536883200 failed, no address space 06:13:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00', 0x0, 0xffffffffffffffff}) 06:13:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000030301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3334.192271][ T6438] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3334.221226][ T6438] binder_transaction: 10 callbacks suppressed 06:13:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xdefe000000000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x300000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3334.221255][ T6438] binder: 6437:6438 transaction failed 29201/-28, size 536870912-12288 line 3147 06:13:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x0, 0xffffffffffffffff}) [ 3334.327032][ T6515] binder: BINDER_SET_CONTEXT_MGR already set [ 3334.351181][ T6515] binder: 6514:6515 ioctl 40046207 0 returned -16 06:13:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000070301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xf0ffffff00000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400000a0301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x0, 0xffffffffffffffff}) 06:13:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x1000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3334.661133][ T6931] binder_alloc: 6924: binder_alloc_buf size 1207971840 failed, no address space 06:13:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400000e0301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3334.710420][ T6931] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3334.724358][ T6931] binder: 6924:6931 transaction failed 29201/-28, size 1207959552-12288 line 3147 06:13:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0xffffffffffffffff}) [ 3334.784159][ T7011] binder: BINDER_SET_CONTEXT_MGR already set [ 3334.816089][ T7011] binder: 6962:7011 ioctl 40046207 0 returned -16 06:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xffffff7f00000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400c00e0301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x0, 0xffffffffffffffff}) [ 3334.831542][ T7011] binder: 6962:7011 transaction failed 29201/-28, size 1275068416-12288 line 3147 06:13:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400593d0301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xffffffff00000000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x0, 0xffffffffffffffff}) 06:13:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x2000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3335.041735][ T7451] binder: 7450:7451 transaction failed 29201/-28, size 1275068416-12288 line 3147 [ 3335.078330][ T7455] binder: BINDER_SET_CONTEXT_MGR already set 06:13:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="14003d590301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3335.130434][ T7455] binder: 7454:7455 ioctl 40046207 0 returned -16 06:13:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00', 0x0, 0xffffffffffffffff}) 06:13:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x0, 0xfffffffffffff000}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000600301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B\x00', 0x0, 0xffffffffffffffff}) [ 3335.342834][ T7870] binder: 7869:7870 transaction failed 29201/-28, size 1610612736-12288 line 3147 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000ec00301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x2, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3335.448232][ T8004] binder: BINDER_SET_CONTEXT_MGR already set [ 3335.475479][ T8004] binder: 7984:8004 ioctl 40046207 0 returned -16 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x0, 0xffffffffffffffff}) 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000f00301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x3000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3335.549154][ T8163] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x0, 0xffffffffffffffff}) 06:13:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000580101ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3335.714323][ T8329] binder: 8326:8329 transaction failed 29201/-28, size 1744830464-12288 line 3147 06:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x3, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x0, 0xffffffffffffffff}) [ 3335.757429][ T8405] binder: BINDER_SET_CONTEXT_MGR already set [ 3335.776030][ T8405] binder: 8386:8405 ioctl 40046207 0 returned -16 [ 3335.797031][ T8405] binder: 8386:8405 transaction failed 29201/-28, size 1811939328-12288 line 3147 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000020301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3335.889872][ T8585] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x0, 0xffffffffffffffff}) 06:13:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x4000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000030301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3335.989798][ T8701] binder: 8697:8701 transaction failed 29201/-28, size 1811939328-12288 line 3147 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x0, 0xffffffffffffffff}) [ 3336.057444][ T8750] binder: BINDER_SET_CONTEXT_MGR already set [ 3336.094911][ T8750] binder: 8716:8750 ioctl 40046207 0 returned -16 06:13:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x7, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x0, 0xffffffffffffffff}) 06:13:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000040301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3336.262858][ T9120] binder: 9093:9120 transaction failed 29201/-28, size 1946157056-12288 line 3147 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\x00', 0x0, 0xffffffffffffffff}) 06:13:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x5000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3336.340068][ T9234] binder: BINDER_SET_CONTEXT_MGR already set [ 3336.366560][ T9234] binder: 9207:9234 ioctl 40046207 0 returned -16 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000070301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0xa, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400000a0301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00', 0x0, 0xffffffffffffffff}) [ 3336.620046][ T9609] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 3336.620059][ T9609] binder_alloc: 9608: binder_alloc_buf size 2046832640 failed, no address space [ 3336.646431][ T9609] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 3336.646447][ T9609] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3336.664164][ T9624] binder: BINDER_SET_CONTEXT_MGR already set 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400000e0301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0xf, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0xffffffffffffffff}) [ 3336.675967][ T9609] binder: 9608:9609 transaction failed 29201/-28, size 2046820352-12288 line 3147 [ 3336.676445][ T9624] binder: 9623:9624 ioctl 40046207 0 returned -16 06:13:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0xffffffffffffffff}) [ 3336.769300][ T9849] netlink: 3 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000600301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03', 0x0, 0xffffffffffffffff}) 06:13:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000901ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3336.993371][T10087] binder_alloc: 10059: binder_alloc_buf size 4294979072 failed, no address space [ 3337.012060][T10087] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x11, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04', 0x0, 0xffffffffffffffff}) [ 3337.046915][T10107] binder: BINDER_SET_CONTEXT_MGR already set [ 3337.081925][T10107] binder: 10106:10107 ioctl 40046207 0 returned -16 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000f00ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3337.126882][T10209] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x7000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05', 0x0, 0xffffffffffffffff}) [ 3337.339836][T10489] binder_alloc: 10488: binder_alloc_buf size 13510798882123776 failed, no address space [ 3337.356096][T10460] binder: BINDER_SET_CONTEXT_MGR already set [ 3337.376326][T10460] binder: 10458:10460 ioctl 40046207 0 returned -16 06:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x67, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06', 0x0, 0xffffffffffffffff}) [ 3337.390386][T10489] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000201ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a', 0x0, 0xffffffffffffffff}) [ 3337.470939][T10707] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x12000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b', 0x0, 0xffffffffffffffff}) [ 3337.603403][T10846] binder: BINDER_SET_CONTEXT_MGR already set [ 3337.641967][T10846] binder: 10841:10846 ioctl 40046207 0 returned -16 06:13:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000801ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x33, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3337.715567][T10934] binder_alloc: 10878: binder_alloc_buf size 72057594037940224 failed, no address space 06:13:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n', 0x0, 0xffffffffffffffff}) [ 3337.800773][T10934] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000901ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3337.850400][T11047] netlink: 'syz-executor.3': attribute type 51 has an invalid length. [ 3337.864170][T11055] binder: BINDER_SET_CONTEXT_MGR already set [ 3337.879686][T11055] binder: 11054:11055 ioctl 40046207 0 returned -16 [ 3337.894876][T11055] binder_alloc: 10878: binder_alloc_buf size 72057594037940224 failed, no address space 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!', 0x0, 0xffffffffffffffff}) [ 3337.924847][T11055] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000302ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x20000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B', 0x0, 0xffffffffffffffff}) 06:13:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x3, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H', 0x0, 0xffffffffffffffff}) 06:13:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000308ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3338.158791][T11443] binder_alloc: 11441: binder_alloc_buf size 144115188075868160 failed, no address space [ 3338.177463][T11456] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 3338.196424][T11443] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000309ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L', 0x0, 0xffffffffffffffff}) 06:13:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3338.304559][T11617] binder: BINDER_SET_CONTEXT_MGR already set [ 3338.320946][T11617] binder: 11595:11617 ioctl 40046207 0 returned -16 06:13:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x3f000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x5, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h', 0x0, 0xffffffffffffffff}) 06:13:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="14000000030bff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3338.452535][T11815] binder_alloc: 11813: binder_alloc_buf size 216172782113796096 failed, no address space 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l', 0x0, 0xffffffffffffffff}) [ 3338.499851][T11815] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff09008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x6, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t', 0x0, 0xffffffffffffffff}) 06:13:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3338.672550][T12159] binder: BINDER_SET_CONTEXT_MGR already set 06:13:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x40000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff10008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3338.756746][T12159] binder: 12148:12159 ioctl 40046207 0 returned -16 [ 3338.794249][T12192] binder_alloc: 12186: binder_alloc_buf size 288230376151724032 failed, no address space 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z', 0x0, 0xffffffffffffffff}) [ 3338.846525][T12192] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf', 0x0, 0xffffffffffffffff}) 06:13:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x9, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07028fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3339.015193][T12522] binder: BINDER_SET_CONTEXT_MGR already set [ 3339.038594][T12522] binder: 12513:12522 ioctl 40046207 0 returned -16 [ 3339.051512][T12522] binder_alloc: 12186: binder_alloc_buf size 288230376151724032 failed, no address space 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd', 0x0, 0xffffffffffffffff}) 06:13:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3339.075690][T12522] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0xa, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07038fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x48000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xfd\xfd', 0x0, 0xffffffffffffffff}) [ 3339.199975][T12768] binder_alloc: 12767: binder_alloc_buf size 360287970189651968 failed, no address space 06:13:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3339.281638][T12768] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\xfd\xff\xff', 0x0, 0xffffffffffffffff}) [ 3339.339688][T12768] binder_transaction: 8 callbacks suppressed [ 3339.339715][T12768] binder: 12767:12768 transaction failed 29201/-28, size 360287970189639680-12288 line 3147 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x4c000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3339.429458][T12964] binder: BINDER_SET_CONTEXT_MGR already set [ 3339.467274][T12964] binder: 12938:12964 ioctl 40046207 0 returned -16 06:13:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07048fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0xb, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x60000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0xc, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3339.732383][T13440] binder: 13429:13440 transaction failed 29201/-28, size 432345564227567616-12288 line 3147 [ 3339.734658][T13442] binder: BINDER_SET_CONTEXT_MGR already set 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3339.775990][T13442] binder: 13441:13442 ioctl 40046207 0 returned -16 06:13:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07078fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3339.861449][T13442] binder: 13441:13442 transaction failed 29201/-28, size 432345564227567616-12288 line 3147 06:13:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x10, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3339.998051][T13708] binder: 13704:13708 transaction failed 29201/-28, size 504403158265495552-12288 line 3147 06:13:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3340.069353][T13905] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff070a8fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x68000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3340.148691][T13977] binder: BINDER_SET_CONTEXT_MGR already set [ 3340.216170][T13977] binder: 13976:13977 ioctl 40046207 0 returned -16 06:13:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff070e8fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x11, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3340.285189][T14064] binder: 14062:14064 transaction failed 29201/-28, size 1297036692682702848-12288 line 3147 [ 3340.375246][T14184] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:43 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07608fbda33d88c000001018dd"], 0x14}}, 0x0) 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6c000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x12, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3340.557054][T14462] binder: 14457:14462 transaction failed 29201/-28, size 2305843009213693952-12288 line 3147 [ 3340.579199][T14494] binder: BINDER_SET_CONTEXT_MGR already set [ 3340.633724][T14494] binder: 14455:14494 ioctl 40046207 0 returned -16 06:13:43 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d881400001018dd"], 0x14}}, 0x0) [ 3340.674466][T14567] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x74000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3340.855181][T14860] binder: 14858:14860 transaction failed 29201/-28, size 1297036692682702848-12288 line 3147 [ 3340.883386][T14893] binder: BINDER_SET_CONTEXT_MGR already set 06:13:43 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c002001018dd"], 0x14}}, 0x0) 06:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x13, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3340.921587][T14893] binder: 14882:14893 ioctl 40046207 0 returned -16 [ 3340.992188][T14991] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x20012008, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x7a000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3341.242413][T15325] binder: 15324:15325 transaction failed 29201/-28, size 2305843009213693952-12288 line 3147 [ 3341.254061][T15328] binder: BINDER_SET_CONTEXT_MGR already set [ 3341.272957][T15328] binder: 15327:15328 ioctl 40046207 0 returned -16 06:13:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c003001018dd"], 0x14}}, 0x0) 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3341.300310][T15328] binder: 15327:15328 transaction failed 29201/-28, size 5188146770730811392-12288 line 3147 [ 3341.325594][T15361] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 06:13:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3341.480840][T15621] binder: 15620:15621 transaction failed 29201/-28, size 5188146770730811392-12288 line 3147 06:13:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c004001018dd"], 0x14}}, 0x0) 06:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x2, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0xfdfdffff, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3341.582339][T15756] binder: BINDER_SET_CONTEXT_MGR already set [ 3341.607483][T15756] binder: 15742:15756 ioctl 40046207 0 returned -16 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3341.791538][T16061] binder_alloc_new_buf_locked: 9 callbacks suppressed [ 3341.791549][T16061] binder_alloc: 16057: binder_alloc_buf size 5476377146882535424 failed, no address space 06:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x3, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3341.846324][T16107] binder: BINDER_SET_CONTEXT_MGR already set [ 3341.874590][T16107] binder: 16104:16107 ioctl 40046207 0 returned -16 [ 3341.898022][T16061] binder_alloc_new_buf_locked: 9 callbacks suppressed [ 3341.898047][T16061] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c007001018dd"], 0x14}}, 0x0) 06:13:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0xfffffdfd, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x5, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3342.211884][T16595] binder_alloc: 16594: binder_alloc_buf size 7493989779944517632 failed, no address space 06:13:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x30000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c00a001018dd"], 0x14}}, 0x0) [ 3342.252359][T16601] binder: BINDER_SET_CONTEXT_MGR already set 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x0, 0xffffffffffffffff}) [ 3342.299439][T16595] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3342.315097][T16601] binder: 16599:16601 ioctl 40046207 0 returned -16 06:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x8, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x0, 0xffffffffffffffff}) 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x0, 0xffffffffffffffff}) 06:13:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x11, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x100000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c00e001018dd"], 0x14}}, 0x0) 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x0, 0xffffffffffffffff}) [ 3342.636609][T17120] binder_alloc: 17119: binder_alloc_buf size 7782220156096229376 failed, no address space [ 3342.673396][T17126] binder: BINDER_SET_CONTEXT_MGR already set [ 3342.689384][T17120] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3342.704879][T17126] binder: 17125:17126 ioctl 40046207 0 returned -16 06:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x300, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0xffffffffffffffff}) 06:13:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x200000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x0, 0xffffffffffffffff}) 06:13:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0xffffff1f, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c060001018dd"], 0x14}}, 0x0) [ 3342.996654][T17541] binder_alloc: 17539: binder_alloc_buf size 8358680908399652864 failed, no address space 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', 0x0, 0xffffffffffffffff}) [ 3343.055313][T17560] binder: BINDER_SET_CONTEXT_MGR already set [ 3343.074096][T17541] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3343.087770][T17560] binder: 17548:17560 ioctl 40046207 0 returned -16 06:13:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x0, 0xffffffffffffffff}) 06:13:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x02'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0f0001018dd"], 0x14}}, 0x0) 06:13:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x300000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00', 0x0, 0xffffffffffffffff}) 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B\x00', 0x0, 0xffffffffffffffff}) [ 3343.383126][T17982] binder_alloc: 17977: binder_alloc_buf size 8358680908399652864 failed, no address space [ 3343.421835][T18041] binder: BINDER_SET_CONTEXT_MGR already set 06:13:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000031018dd"], 0x14}}, 0x0) [ 3343.449710][T17982] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3343.459593][T18041] binder: 18030:18041 ioctl 40046207 0 returned -16 06:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x03'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x0, 0xffffffffffffffff}) [ 3343.710175][T18298] binder_alloc: 18297: binder_alloc_buf size 8791026472627220480 failed, no address space [ 3343.722628][T18298] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3343.741487][T18301] binder: BINDER_SET_CONTEXT_MGR already set 06:13:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000071018dd"], 0x14}}, 0x0) [ 3343.769521][T18301] binder: 18300:18301 ioctl 40046207 0 returned -16 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x0, 0xffffffffffffffff}) 06:13:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3343.961471][T18690] binder_alloc: 18689: binder_alloc_buf size -144678142324232192 failed, no address space 06:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x04'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x400000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x0, 0xffffffffffffffff}) [ 3344.008219][T18690] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x0, 0xffffffffffffffff}) [ 3344.063159][T18761] binder: BINDER_SET_CONTEXT_MGR already set [ 3344.076185][T18761] binder: 18729:18761 ioctl 40046207 0 returned -16 06:13:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0000a1018dd"], 0x14}}, 0x0) 06:13:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3344.122483][T18761] binder_alloc: 18689: binder_alloc_buf size -144678142324232192 failed, no address space [ 3344.155035][T18761] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x0, 0xffffffffffffffff}) 06:13:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x06'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3344.263905][T19016] binder: 19008:19016 got transaction with invalid offsets size, 10 06:13:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x0, 0xffffffffffffffff}) 06:13:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0000e1018dd"], 0x14}}, 0x0) 06:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\n'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x500000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3344.513095][T19364] binder_alloc: 19358: binder_alloc_buf size -4294955008 failed, no address space [ 3344.525819][T19367] binder: BINDER_SET_CONTEXT_MGR already set [ 3344.534371][T19367] binder: 19363:19367 ioctl 40046207 0 returned -16 [ 3344.543007][T19364] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\x00', 0x0, 0xffffffffffffffff}) [ 3344.567434][T19367] binder: 19363:19367 got transaction with invalid offsets size, 99 [ 3344.581789][T19364] binder_transaction: 9 callbacks suppressed [ 3344.581810][T19364] binder: 19358:19364 transaction failed 29201/-28, size -4294967296-12288 line 3147 06:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\f'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0c00e1018dd"], 0x14}}, 0x0) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00', 0x0, 0xffffffffffffffff}) 06:13:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x0, 0xffffffffffffffff}) [ 3344.857670][T19836] binder: 19834:19836 got transaction with invalid offset (0, min 0 max 0) or object. [ 3344.874397][T19874] binder: BINDER_SET_CONTEXT_MGR already set [ 3344.886551][T19836] binder: 19834:19836 transaction failed 29201/-22, size 0-2560 line 3241 06:13:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x600000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x0e'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3344.912635][T19874] binder: 19861:19874 ioctl 40046207 0 returned -16 06:13:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0593d1018dd"], 0x14}}, 0x0) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x0, 0xffffffffffffffff}) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0xffffffffffffffff}) 06:13:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x0, 0xffffffffffffffff}) [ 3345.179930][T20242] binder: 20235:20242 got transaction with invalid offsets ptr [ 3345.205606][T20283] binder: BINDER_SET_CONTEXT_MGR already set 06:13:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x0f'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3345.223729][T20242] binder: 20235:20242 transaction failed 29201/-14, size 0-8192 line 3193 06:13:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c03d591018dd"], 0x14}}, 0x0) [ 3345.250768][T20283] binder: 20281:20283 ioctl 40046207 0 returned -16 06:13:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x700000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x0, 0xffffffffffffffff}) 06:13:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2300, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2300, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00', 0x0, 0xffffffffffffffff}) 06:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x10'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:48 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000601018dd"], 0x14}}, 0x0) [ 3345.569983][T20667] binder: 20666:20667 got transaction with invalid offsets ptr [ 3345.583611][T20669] binder: BINDER_SET_CONTEXT_MGR already set [ 3345.584972][T20667] binder: 20666:20667 transaction failed 29201/-14, size 0-8960 line 3193 [ 3345.601952][T20669] binder: 20661:20669 ioctl 40046207 0 returned -16 06:13:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B\x00', 0x0, 0xffffffffffffffff}) [ 3345.631662][T20667] binder_alloc: binder_alloc_mmap_handler: 20666 20001000-20004000 already mapped failed -16 [ 3345.662546][T20667] binder: BINDER_SET_CONTEXT_MGR already set 06:13:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x1200000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3345.690424][T20667] binder: 20666:20667 ioctl 40046207 0 returned -16 06:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit`'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x0, 0xffffffffffffffff}) 06:13:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3345.884841][T21082] binder: BINDER_SET_CONTEXT_MGR already set 06:13:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x0, 0xffffffffffffffff}) 06:13:48 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c00ec01018dd"], 0x14}}, 0x0) [ 3345.938139][T21082] binder: 21068:21082 ioctl 40046207 0 returned -16 [ 3345.973877][T21211] binder: 21197:21211 got transaction with invalid offsets ptr 06:13:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x2000000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3345.984084][T21211] binder: 21197:21211 transaction failed 29201/-14, size 0-11008 line 3193 06:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xf0'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x0, 0xffffffffffffffff}) 06:13:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3346.210411][T21558] binder_alloc: 21557: binder_alloc_buf failed to map page at 20002000 in userspace [ 3346.237670][T21581] binder: BINDER_SET_CONTEXT_MGR already set 06:13:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x3f00000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3346.255342][T21558] binder: 21557:21558 transaction failed 29201/-12, size 0-11520 line 3147 06:13:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3346.281843][T21581] binder: 21577:21581 ioctl 40046207 0 returned -16 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x0, 0xffffffffffffffff}) 06:13:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000f01018dd"], 0x14}}, 0x0) 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x0, 0xffffffffffffffff}) 06:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3002, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x0, 0xffffffffffffffff}) 06:13:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x4000000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000000718dd"], 0x14}}, 0x0) [ 3346.601376][T22068] binder: 22066:22068 got transaction with invalid offsets ptr [ 3346.623281][T22072] binder: BINDER_SET_CONTEXT_MGR already set 06:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3346.656563][T22068] binder: 22066:22068 transaction failed 29201/-14, size 0-12032 line 3193 [ 3346.665279][T22072] binder: 22051:22072 ioctl 40046207 0 returned -16 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\x00', 0x0, 0xffffffffffffffff}) 06:13:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3002, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00', 0x0, 0xffffffffffffffff}) 06:13:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3003, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x4800000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3346.906553][T22468] binder_alloc: 22461: binder_alloc_buf size 12296 failed, no address space [ 3346.934890][T22523] binder: BINDER_SET_CONTEXT_MGR already set 06:13:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000000a18dd"], 0x14}}, 0x0) [ 3346.972811][T22523] binder: 22520:22523 ioctl 40046207 0 returned -16 [ 3346.977923][T22468] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3347.032935][T22468] binder: 22461:22468 transaction failed 29201/-28, size 0-12290 line 3147 06:13:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3004, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x4c00000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3003, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3347.261028][T23000] binder: BINDER_SET_CONTEXT_MGR already set [ 3347.282886][T23000] binder: 22982:23000 ioctl 40046207 0 returned -16 06:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3347.397091][T23038] binder_alloc: 23006: binder_alloc_buf size 12296 failed, no address space 06:13:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000021018dd"], 0x14}}, 0x0) 06:13:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3005, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3347.439686][T23038] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3347.462789][T23038] binder: 23006:23038 transaction failed 29201/-28, size 0-12291 line 3147 06:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6000000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3347.570554][T23370] binder: BINDER_SET_CONTEXT_MGR already set [ 3347.590061][T23370] binder: 23291:23370 ioctl 40046207 0 returned -16 [ 3347.653219][T23370] binder_alloc: 23006: binder_alloc_buf size 12296 failed, no address space 06:13:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3004, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3347.694376][T23370] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3347.753528][T23523] binder_alloc: 23522: binder_alloc_buf size 12296 failed, no address space [ 3347.763322][T23370] binder: 23291:23370 transaction failed 29201/-28, size 0-12293 line 3147 06:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'site'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3347.797829][T23523] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000031018dd"], 0x14}}, 0x0) 06:13:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3006, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6800000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xaf'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3005, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3348.016990][T23987] binder: BINDER_SET_CONTEXT_MGR already set [ 3348.073272][T23987] binder: 23985:23987 ioctl 40046207 0 returned -16 06:13:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3348.132393][T24026] binder_alloc: 24020: binder_alloc_buf size 12296 failed, no address space [ 3348.152705][T24026] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000041018dd"], 0x14}}, 0x0) 06:13:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3007, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3006, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3348.383696][T24471] binder: BINDER_SET_CONTEXT_MGR already set [ 3348.394185][T24471] binder: 24436:24471 ioctl 40046207 0 returned -16 06:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sitX'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x6c00000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000071018dd"], 0x14}}, 0x0) [ 3348.453673][T24532] binder_alloc: 24505: binder_alloc_buf size 12296 failed, no address space [ 3348.485836][T24532] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3012, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3007, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3348.682901][T24833] binder_alloc: 24832: binder_alloc_buf size 12312 failed, no address space [ 3348.733586][T24833] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sitX'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3348.775017][T24879] binder: BINDER_SET_CONTEXT_MGR already set [ 3348.798819][T24879] binder: 24876:24879 ioctl 40046207 0 returned -16 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0000a1018dd"], 0x14}}, 0x0) 06:13:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3048, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x7400000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300a, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3349.035004][T25253] binder_alloc: 25252: binder_alloc_buf size 12360 failed, no address space [ 3349.038633][T25258] binder: BINDER_SET_CONTEXT_MGR already set 06:13:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0000e1018dd"], 0x14}}, 0x0) 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xfe'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3349.080456][T25253] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3349.100259][T25258] binder: 25257:25258 ioctl 40046207 0 returned -16 06:13:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000601018dd"], 0x14}}, 0x0) 06:13:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x304c, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3012, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x7a00000000000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3349.394339][T25690] binder_alloc: 25689: binder_alloc_buf size 12368 failed, no address space 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3349.455368][T25690] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3349.461872][T25753] binder: BINDER_SET_CONTEXT_MGR already set [ 3349.490121][T25753] binder: 25734:25753 ioctl 40046207 0 returned -16 06:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xde'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3349.525952][T25753] binder_alloc: 25689: binder_alloc_buf size 12312 failed, no address space [ 3349.543148][T25753] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:52 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000000218dd"], 0x14}}, 0x0) 06:13:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3060, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3048, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xfd', 0x0, 0xffffffffffffffff}) 06:13:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0xfdfdffff00000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3349.809747][T26217] binder_transaction: 8 callbacks suppressed [ 3349.809766][T26217] binder: 26216:26217 transaction failed 29201/-28, size 0-12360 line 3147 [ 3349.844736][T26215] binder: BINDER_SET_CONTEXT_MGR already set 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\xfd\xff', 0x0, 0xffffffffffffffff}) 06:13:52 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000000718dd"], 0x14}}, 0x0) [ 3349.864825][T26215] binder: 26212:26215 ioctl 40046207 0 returned -16 06:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x304c, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3068, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xff'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3350.166184][T26718] binder: 26693:26718 transaction failed 29201/-28, size 0-12364 line 3147 [ 3350.190965][T26737] binder: BINDER_SET_CONTEXT_MGR already set 06:13:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0xffffffff00000000, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3350.216396][T26737] binder: 26736:26737 ioctl 40046207 0 returned -16 [ 3350.233384][T26737] binder: 26736:26737 transaction failed 29201/-28, size 0-12392 line 3147 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000000a18dd"], 0x14}}, 0x0) 06:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3060, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x306c, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3350.501096][T27142] binder: 27118:27142 transaction failed 29201/-28, size 0-12384 line 3147 [ 3350.518305][T27182] binder: BINDER_SET_CONTEXT_MGR already set [ 3350.525014][T27182] binder: 27155:27182 ioctl 40046207 0 returned -16 [ 3350.543410][T27182] binder: 27155:27182 transaction failed 29201/-28, size 0-12396 line 3147 06:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x630b, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3068, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3074, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0xf}}, 0x0) [ 3350.733566][T27516] binder: 27514:27516 ERROR: BC_REGISTER_LOOPER called without request [ 3350.756350][T27529] binder: 27528:27529 transaction failed 29201/-28, size 0-12392 line 3147 06:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0xc0}}, 0x0) [ 3350.785849][T27516] binder: 27514:27516 unknown command 0 [ 3350.795298][T27576] binder: BINDER_SET_CONTEXT_MGR already set [ 3350.798529][T27516] binder: 27514:27516 ioctl c0306201 20000040 returned -22 [ 3350.822377][T27576] binder: 27564:27576 ioctl 40046207 0 returned -16 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x306c, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x307a, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3351.091417][T27947] binder: 27936:27947 transaction failed 29201/-28, size 0-12396 line 3147 06:13:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x630c, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0xec0}}, 0x0) 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3351.132500][T27989] binder: BINDER_SET_CONTEXT_MGR already set [ 3351.149504][T27989] binder: 27988:27989 ioctl 40046207 0 returned -16 [ 3351.162424][T27989] binder: 27988:27989 transaction failed 29201/-28, size 0-12410 line 3147 06:13:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3074, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3351.274349][T28097] binder: 28095:28097 unknown command 0 [ 3351.296623][T28097] binder: 28095:28097 ioctl c0306201 20000040 returned -22 06:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x33fe0}}, 0x0) 06:13:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3351.437303][T28378] binder: 28361:28378 transaction failed 29201/-28, size 0-12404 line 3147 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3351.530017][T28502] binder: BINDER_SET_CONTEXT_MGR already set 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x630d, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3351.572556][T28502] binder: 28501:28502 ioctl 40046207 0 returned -16 06:13:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x20000594}}, 0x0) 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x307a, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3351.690820][T28769] binder: 28737:28769 unknown command 0 [ 3351.711150][T28769] binder: 28737:28769 ioctl c0306201 20000040 returned -22 06:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x7ffff000}}, 0x0) 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3351.832362][T28841] binder: 28836:28841 transaction failed 29201/-28, size 0-12410 line 3147 [ 3351.852970][T28850] binder: BINDER_SET_CONTEXT_MGR already set [ 3351.890010][T28850] binder: 28839:28850 ioctl 40046207 0 returned -16 06:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x2}, 0x0) 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40046302, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d00, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3352.162722][T29328] binder: BC_ACQUIRE_RESULT not supported [ 3352.176023][T29328] binder: 29327:29328 ioctl c0306201 20000040 returned -22 [ 3352.178085][T29362] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 3352.178095][T29362] binder_alloc: 29361: binder_alloc_buf size 23808 failed, no address space 06:13:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x8}, 0x0) 06:13:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3352.214290][T29363] binder: BINDER_SET_CONTEXT_MGR already set [ 3352.218748][T29362] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 3352.218767][T29362] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3352.240444][T29363] binder: 29360:29363 ioctl 40046207 0 returned -16 06:13:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x9}, 0x0) 06:13:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40046304, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6500, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3352.568211][T29785] binder: 29780:29785 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 3352.576369][T29784] binder_alloc: 29782: binder_alloc_buf failed to map page at 20002000 in userspace [ 3352.584128][T29785] binder: 29780:29785 unknown command 0 [ 3352.600502][T29788] binder: BINDER_SET_CONTEXT_MGR already set [ 3352.607169][T29785] binder: 29780:29785 ioctl c0306201 20000040 returned -22 [ 3352.614769][T29788] binder: 29786:29788 ioctl 40046207 0 returned -16 [ 3352.630413][T29788] binder_alloc: 29782: binder_alloc_buf size 25856 failed, no address space [ 3352.640631][T29788] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:13:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0xb}, 0x0) 06:13:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x5]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x0, 0xffffffffffffffff}) 06:13:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5f5e0ff, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3352.864879][T30201] binder_alloc: 30200: binder_alloc_buf failed to map page at 20002000 in userspace 06:13:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40046307, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0x0, 0xffffffffffffffff}) 06:13:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x300}, 0x0) 06:13:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3353.010043][T30409] binder: BINDER_SET_CONTEXT_MGR already set [ 3353.024091][T30410] binder: 30408:30410 DecRefs 0 refcount change on invalid ref 0 ret -22 06:13:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x0, 0xffffffffffffffff}) [ 3353.055998][T30409] binder: 30407:30409 ioctl 40046207 0 returned -16 [ 3353.077024][T30410] binder: 30408:30410 unknown command 0 [ 3353.098789][T30410] binder: 30408:30410 ioctl c0306201 20000040 returned -22 06:13:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3353.243166][T30591] binder: 30590:30591 got transaction with invalid offsets ptr [ 3353.255314][T30597] binder: BINDER_SET_CONTEXT_MGR already set 06:13:56 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0xffffff1f}, 0x0) 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0x0, 0xffffffffffffffff}) [ 3353.294928][T30597] binder: 30575:30597 ioctl 40046207 0 returned -16 06:13:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40086303, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0xffffffffffffffff}) 06:13:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x2}, 0x0) 06:13:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3353.527824][T30960] binder: 30959:30960 BC_FREE_BUFFER u0000000000000000 no match [ 3353.530475][T30997] binder: 30990:30997 got transaction with invalid offsets ptr [ 3353.570802][T31043] binder: BINDER_SET_CONTEXT_MGR already set [ 3353.578670][T30960] binder: 30959:30960 unknown command 0 [ 3353.597984][T31043] binder: 31018:31043 ioctl 40046207 0 returned -16 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00', 0x0, 0xffffffffffffffff}) 06:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xff'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3353.617345][T30960] binder: 30959:30960 ioctl c0306201 20000040 returned -22 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', 0x0, 0xffffffffffffffff}) 06:13:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x12]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x3}, 0x0) 06:13:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x4008630a, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xff'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00', 0x0, 0xffffffffffffffff}) [ 3353.857210][T31450] binder_alloc: 31444: binder_alloc_buf failed to map page at 20002000 in userspace [ 3353.962408][T31505] binder: BINDER_SET_CONTEXT_MGR already set [ 3353.996910][T31577] binder: BC_ATTEMPT_ACQUIRE not supported 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x00', 0x0, 0xffffffffffffffff}) [ 3354.010773][T31505] binder: 31472:31505 ioctl 40046207 0 returned -16 [ 3354.018208][T31577] binder: 31566:31577 ioctl c0306201 20000040 returned -22 06:13:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x30]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x5]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:56 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x4}, 0x0) [ 3354.156546][T31800] binder_alloc: 31793: binder_alloc_buf failed to map page at 20002000 in userspace 06:13:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B\x00', 0x0, 0xffffffffffffffff}) [ 3354.275152][T31981] binder: BINDER_SET_CONTEXT_MGR already set [ 3354.282355][T31981] binder: 31873:31981 ioctl 40046207 0 returned -16 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H\x00', 0x0, 0xffffffffffffffff}) 06:13:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40086310, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x7}, 0x0) 06:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x48]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3354.428340][T32163] binder: 32162:32163 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 3354.464640][T32163] binder: 32162:32163 unknown command 0 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L\x00', 0x0, 0xffffffffffffffff}) [ 3354.472367][T32163] binder: 32162:32163 ioctl c0306201 20000040 returned -22 [ 3354.487082][T32198] binder_alloc: 32197: binder_alloc_buf failed to map page at 20002000 in userspace 06:13:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x00', 0x0, 0xffffffffffffffff}) 06:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xff'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3354.595279][T32352] binder: BINDER_SET_CONTEXT_MGR already set [ 3354.634230][T32352] binder: 32344:32352 ioctl 40046207 0 returned -16 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l\x00', 0x0, 0xffffffffffffffff}) 06:13:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xa}, 0x0) 06:13:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x400c630e, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3354.762310][T32558] binder_alloc: 32554: binder_alloc_buf failed to map page at 20002000 in userspace 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t\x00', 0x0, 0xffffffffffffffff}) 06:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x88'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3354.849506][T32698] binder: 32604:32698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 3354.850548][T32558] binder_transaction: 10 callbacks suppressed [ 3354.850566][T32558] binder: 32554:32558 transaction failed 29201/-12, size 0-12288 line 3147 06:13:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3354.894738][T32698] binder: 32604:32698 unknown command 0 [ 3354.923407][T32698] binder: 32604:32698 ioctl c0306201 20000040 returned -22 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z\x00', 0x0, 0xffffffffffffffff}) 06:13:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xe}, 0x0) [ 3354.973121][ T300] binder: BINDER_SET_CONTEXT_MGR already set [ 3355.002405][ T300] binder: 32763:300 ioctl 40046207 0 returned -16 06:13:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x60]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf\x00', 0x0, 0xffffffffffffffff}) 06:13:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xa]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\x00', 0x0, 0xffffffffffffffff}) [ 3355.213177][ T677] binder_alloc: 661: binder_alloc_buf failed to map page at 20002000 in userspace [ 3355.262451][ T725] binder: BINDER_SET_CONTEXT_MGR already set [ 3355.281644][ T677] binder: 661:677 transaction failed 29201/-12, size 0-12288 line 3147 [ 3355.299278][ T725] binder: 704:725 ioctl 40046207 0 returned -16 06:13:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x400c630f, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x60}, 0x0) 06:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x7f'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03', 0x0, 0xffffffffffffffff}) 06:13:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x12]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xf0}, 0x0) [ 3355.481908][ T979] binder: 861:979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 06:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x9e'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x68]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3355.530568][ T979] binder: 861:979 unknown command 0 [ 3355.546025][ T979] binder: 861:979 ioctl c0306201 20000040 returned -22 06:13:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05', 0x0, 0xffffffffffffffff}) [ 3355.615973][ T1102] binder: 1101:1102 got transaction with invalid offsets ptr [ 3355.633267][ T1102] binder: 1101:1102 transaction failed 29201/-14, size 0-12288 line 3193 [ 3355.638719][ T1132] binder: BINDER_SET_CONTEXT_MGR already set [ 3355.675026][ T1132] binder: 1118:1132 ioctl 40046207 0 returned -16 06:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xf0'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x30]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06', 0x0, 0xffffffffffffffff}) 06:13:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40106308, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x300}, 0x0) [ 3355.876219][ T1595] binder: 1581:1595 got transaction with invalid offsets ptr [ 3355.893635][ T1595] binder: 1581:1595 transaction failed 29201/-14, size 0-12288 line 3193 06:13:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a', 0x0, 0xffffffffffffffff}) [ 3355.924619][ T1633] binder: BINDER_SET_CONTEXT_MGR already set 06:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3355.987364][ T1673] binder: 1656:1673 BC_INCREFS_DONE u0000000000000000 no match 06:13:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n', 0x0, 0xffffffffffffffff}) 06:13:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x700}, 0x0) [ 3356.030884][ T1633] binder: 1632:1633 ioctl 40046207 0 returned -16 [ 3356.038339][ T1673] binder: 1656:1673 unknown command 0 [ 3356.043906][ T1673] binder: 1656:1673 ioctl c0306201 20000040 returned -22 06:13:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x74]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\xff'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!', 0x0, 0xffffffffffffffff}) 06:13:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x48]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3356.243801][ T2025] binder: BINDER_SET_CONTEXT_MGR already set [ 3356.266018][ T2025] binder: 2019:2025 ioctl 40046207 0 returned -16 [ 3356.307930][ T2116] binder: 2113:2116 got transaction with invalid offsets ptr 06:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3356.348504][ T2116] binder: 2113:2116 transaction failed 29201/-14, size 0-12288 line 3193 06:13:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40106309, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B', 0x0, 0xffffffffffffffff}) 06:13:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xa00}, 0x0) [ 3356.461541][ T2329] binder: 2328:2329 BC_ACQUIRE_DONE u0000000000000000 no match 06:13:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H', 0x0, 0xffffffffffffffff}) [ 3356.517765][ T2329] binder: 2328:2329 unknown command 0 [ 3356.551137][ T2329] binder: 2328:2329 ioctl c0306201 20000040 returned -22 06:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3356.622265][ T2479] binder_alloc: 2446: binder_alloc_buf failed to map page at 20002000 in userspace [ 3356.648336][ T2512] binder: BINDER_SET_CONTEXT_MGR already set [ 3356.658445][ T2512] binder: 2507:2512 ioctl 40046207 0 returned -16 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L', 0x0, 0xffffffffffffffff}) [ 3356.668724][ T2479] binder: 2446:2479 transaction failed 29201/-12, size 0-12288 line 3147 [ 3356.690234][ T2512] binder_alloc: 2446: binder_alloc_buf failed to map page at 20002000 in userspace [ 3356.712084][ T2512] binder: 2507:2512 transaction failed 29201/-12, size 0-12288 line 3147 06:13:59 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xe00}, 0x0) 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h', 0x0, 0xffffffffffffffff}) 06:13:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x60]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40400a00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x300]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3356.942829][ T2931] binder: 2930:2931 got transaction with invalid offsets ptr [ 3356.953029][ T2935] binder: 2934:2935 unknown command 1077938688 [ 3356.964480][ T2935] binder: 2934:2935 ioctl c0306201 20000040 returned -22 [ 3356.982274][ T2931] binder: 2930:2931 transaction failed 29201/-14, size 0-12288 line 3193 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l', 0x0, 0xffffffffffffffff}) [ 3356.982781][ T2938] binder: BINDER_SET_CONTEXT_MGR already set [ 3357.010735][ T2938] binder: 2937:2938 ioctl 40046207 0 returned -16 06:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t', 0x0, 0xffffffffffffffff}) 06:13:59 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xec0}, 0x0) 06:13:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x68]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z', 0x0, 0xffffffffffffffff}) 06:13:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x500]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:13:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3357.257936][ T3443] binder: 3439:3443 got transaction with invalid offsets ptr 06:14:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402000, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3357.302342][ T3443] binder: 3439:3443 transaction failed 29201/-14, size 0-12288 line 3193 [ 3357.354298][ T3523] binder: BINDER_SET_CONTEXT_MGR already set [ 3357.376712][ T3523] binder: 3522:3523 ioctl 40046207 0 returned -16 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf', 0x0, 0xffffffffffffffff}) 06:14:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x3d59}, 0x0) [ 3357.399781][ T3523] binder: 3522:3523 got transaction with invalid offsets ptr [ 3357.411067][ T3523] binder: 3522:3523 transaction failed 29201/-14, size 0-12288 line 3193 06:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3357.451970][ T3587] binder: 3554:3587 unknown command 1077944320 [ 3357.482928][ T3587] binder: 3554:3587 ioctl c0306201 20000040 returned -22 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd', 0x0, 0xffffffffffffffff}) 06:14:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x600]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x593d}, 0x0) 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3357.651444][ T3916] binder: 3891:3916 got transaction with invalid offsets ptr [ 3357.678180][ T3927] binder: BINDER_SET_CONTEXT_MGR already set [ 3357.684227][ T3927] binder: 3926:3927 ioctl 40046207 0 returned -16 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x74]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x6000}, 0x0) 06:14:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x700]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3358.007681][ T4311] binder: 4305:4311 got transaction with invalid offsets ptr [ 3358.023966][ T4329] binder: BINDER_SET_CONTEXT_MGR already set [ 3358.047001][ T4329] binder: 4308:4329 ioctl 40046207 0 returned -16 06:14:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3358.065502][ T4375] binder: 4340:4375 unknown command 1077945088 [ 3358.086201][ T4375] binder: 4340:4375 ioctl c0306201 20000040 returned -22 06:14:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xc00e}, 0x0) 06:14:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x1200]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3358.267417][ T4741] binder_alloc: 4722: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402500, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3358.352161][ T4796] binder: BINDER_SET_CONTEXT_MGR already set [ 3358.364010][ T4796] binder: 4792:4796 ioctl 40046207 0 returned -16 06:14:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3358.473087][ T5034] binder: 4984:5034 unknown command 1077945600 [ 3358.503231][ T5034] binder: 4984:5034 ioctl c0306201 20000040 returned -22 [ 3358.519049][ T5103] binder_alloc: 5099: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x300]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:01 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xf000}, 0x0) [ 3358.628472][ T5196] binder: BINDER_SET_CONTEXT_MGR already set 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3358.671646][ T5196] binder: 5178:5196 ioctl 40046207 0 returned -16 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:01 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x34000}, 0x0) [ 3358.786956][ T5392] binder_alloc: 5374: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x500]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402a00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3f00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3358.973868][ T5595] binder: BINDER_SET_CONTEXT_MGR already set [ 3358.980451][ T5595] binder: 5592:5595 ioctl 40046207 0 returned -16 [ 3358.989021][ T5595] binder_alloc: 5374: binder_alloc_buf failed to map page at 20002000 in userspace [ 3359.020892][ T5645] binder: 5607:5645 unknown command 1077946880 [ 3359.034144][ T5645] binder: 5607:5645 ioctl c0306201 20000040 returned -22 [ 3359.061876][ T5706] binder: BINDER_SET_CONTEXT_MGR already set 06:14:01 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x400300}, 0x0) 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3359.085447][ T5706] binder: 5704:5706 ioctl 40046207 0 returned -16 06:14:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x600]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402b00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4800]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xf0ffff}, 0x0) [ 3359.329643][ T6115] binder: 6113:6115 unknown command 1077947136 [ 3359.357969][ T6115] binder: 6113:6115 ioctl c0306201 20000040 returned -22 06:14:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3359.380813][ T6130] binder: 6129:6130 got transaction with invalid offsets ptr [ 3359.437080][ T6173] binder: BINDER_SET_CONTEXT_MGR already set [ 3359.449337][ T6173] binder: 6153:6173 ioctl 40046207 0 returned -16 [ 3359.477991][ T6173] binder: 6153:6173 got transaction with invalid offsets ptr 06:14:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x700]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3359.598993][ T6468] binder: 6447:6468 got transaction with invalid offsets ptr 06:14:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402d00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x1000000}, 0x0) [ 3359.767059][ T6672] binder: 6669:6672 unknown command 1077947648 [ 3359.772203][ T6664] binder: BINDER_SET_CONTEXT_MGR already set [ 3359.780262][ T6672] binder: 6669:6672 ioctl c0306201 20000040 returned -22 [ 3359.808819][ T6664] binder: 6641:6664 ioctl 40046207 0 returned -16 06:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xa00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3359.854946][ T6664] binder_alloc: 6447: binder_alloc_buf, no vma [ 3359.892343][ T6664] binder_transaction: 9 callbacks suppressed 06:14:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x2000000}, 0x0) [ 3359.892361][ T6664] binder: 6641:6664 transaction failed 29189/-3, size 0-12288 line 3147 [ 3359.918998][ T6796] binder: 6795:6796 got transaction with invalid offsets ptr [ 3359.938999][ T6796] binder: 6795:6796 transaction failed 29201/-14, size 0-12288 line 3193 06:14:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40402e00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x3000000}, 0x0) 06:14:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x1200]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3360.180346][ T7196] binder: BINDER_SET_CONTEXT_MGR already set [ 3360.193209][ T7198] binder: 7197:7198 unknown command 1077947904 [ 3360.209341][ T7196] binder: 7195:7196 ioctl 40046207 0 returned -16 06:14:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3360.230458][ T7198] binder: 7197:7198 ioctl c0306201 20000040 returned -22 [ 3360.266703][ T7221] binder: 7204:7221 got transaction with invalid offsets ptr 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3360.291545][ T7221] binder: 7204:7221 transaction failed 29201/-14, size 0-12288 line 3193 06:14:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6800]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:03 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x4000000}, 0x0) 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff', 0x0, 0xffffffffffffffff}) 06:14:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3360.455335][ T7572] binder: BINDER_SET_CONTEXT_MGR already set [ 3360.470388][ T7572] binder: 7542:7572 ioctl 40046207 0 returned -16 [ 3360.490396][ T7572] binder: 7542:7572 got transaction with invalid offsets ptr [ 3360.507717][ T7572] binder: 7542:7572 transaction failed 29201/-14, size 0-12288 line 3193 06:14:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40403000, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3360.616080][ T7661] binder: 7657:7661 got transaction with invalid offsets ptr [ 3360.653009][ T7661] binder: 7657:7661 transaction failed 29201/-14, size 0-12288 line 3193 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\xfd', 0x0, 0xffffffffffffffff}) [ 3360.672636][ T7731] binder: 7667:7731 unknown command 1077948416 [ 3360.679632][ T7731] binder: 7667:7731 ioctl c0306201 20000040 returned -22 06:14:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:03 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x7000000}, 0x0) 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3360.819792][ T8024] binder: BINDER_SET_CONTEXT_MGR already set [ 3360.840885][ T8024] binder: 8020:8024 ioctl 40046207 0 returned -16 06:14:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7400]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3360.947823][ T8207] binder: 8173:8207 got transaction with invalid offsets ptr [ 3360.967917][ T8207] binder: 8173:8207 transaction failed 29201/-14, size 0-12288 line 3193 06:14:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40405800, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3361.109075][ T8333] binder: 8325:8333 unknown command 1077958656 [ 3361.119735][ T8350] binder: BINDER_SET_CONTEXT_MGR already set [ 3361.138990][ T8350] binder: 8345:8350 ioctl 40046207 0 returned -16 06:14:03 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xa000000}, 0x0) [ 3361.152681][ T8333] binder: 8325:8333 ioctl c0306201 20000040 returned -22 06:14:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4800]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3361.298977][ T8653] binder: 8639:8653 got transaction with invalid offsets ptr 06:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3361.351163][ T8653] binder: 8639:8653 transaction failed 29201/-14, size 0-12288 line 3193 [ 3361.371600][ T8729] binder: BINDER_SET_CONTEXT_MGR already set [ 3361.385993][ T8729] binder: 8719:8729 ioctl 40046207 0 returned -16 06:14:04 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xe000000}, 0x0) 06:14:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406301, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3361.436451][ T8729] binder: 8719:8729 got transaction with invalid offsets ptr [ 3361.456148][ T8729] binder: 8719:8729 transaction failed 29201/-14, size 0-12288 line 3193 06:14:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x0) [ 3361.532799][ T9011] binder: 9010:9011 got reply transaction with no transaction stack [ 3361.553524][ T9011] binder: 9010:9011 transaction failed 29201/-71, size 0-12288 line 2899 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x300000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3361.681832][ T9215] binder: 9207:9215 transaction failed 29201/-14, size 0-12288 line 3193 06:14:04 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x3d590000}, 0x0) 06:14:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406302, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3361.798486][ T9433] binder: BINDER_SET_CONTEXT_MGR already set [ 3361.825349][ T9433] binder: 9374:9433 ioctl 40046207 0 returned -16 06:14:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x3}}}]}, 0xff0e}}, 0x0) [ 3361.893305][ T9475] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. [ 3361.918018][ T9472] binder: 9466:9472 unknown command 1077961474 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3361.937529][ T9472] binder: 9466:9472 ioctl c0306201 20000040 returned -22 06:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x5}}}]}, 0xff0e}}, 0x0) 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x1000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:04 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x60000000}, 0x0) [ 3362.081622][ T9808] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. 06:14:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6800]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3362.201566][ T9954] binder_alloc: 9952: binder_alloc_buf failed to map page at 20002000 in userspace [ 3362.222918][ T9973] binder: BINDER_SET_CONTEXT_MGR already set [ 3362.236403][ T9973] binder: 9945:9973 ioctl 40046207 0 returned -16 06:14:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x11}}}]}, 0xff0e}}, 0x0) [ 3362.251677][ T9973] binder_alloc: 9952: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406303, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3362.322878][T10042] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. 06:14:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3362.372388][T10114] binder: 10096:10114 unknown command 1077961475 [ 3362.385694][T10114] binder: 10096:10114 ioctl c0306201 20000040 returned -22 06:14:05 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x9effffff}, 0x0) 06:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4, 0x3}}}]}, 0xff0e}}, 0x0) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3362.489745][T10341] binder_alloc: 10335: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406304, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3362.610851][T10426] binder: BINDER_SET_CONTEXT_MGR already set [ 3362.638363][T10426] binder: 10422:10426 ioctl 40046207 0 returned -16 06:14:05 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xc00e0000}, 0x0) 06:14:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3362.736305][T10647] binder: 10569:10647 unknown command 1077961476 06:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4, 0x5}}}]}, 0xff0e}}, 0x0) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3362.801847][T10737] binder_alloc: 10736: binder_alloc_buf failed to map page at 20002000 in userspace [ 3362.831176][T10647] binder: 10569:10647 ioctl c0306201 20000040 returned -22 06:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7400]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3362.904135][T10781] binder: BINDER_SET_CONTEXT_MGR already set [ 3362.929215][T10781] binder: 10743:10781 ioctl 40046207 0 returned -16 06:14:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4, 0x11}}}]}, 0xff0e}}, 0x0) 06:14:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:05 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xf0ffffff}, 0x0) [ 3363.146375][T11146] binder_alloc: 11139: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406305, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a00]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3363.293365][T11199] binder: BINDER_SET_CONTEXT_MGR already set 06:14:06 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xfffff000}, 0x0) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3363.348374][T11199] binder: 11198:11199 ioctl 40046207 0 returned -16 [ 3363.360478][T11269] binder: 11268:11269 unknown command 1077961477 [ 3363.381831][T11199] binder_alloc: 11139: binder_alloc_buf failed to map pages in userspace, no vma [ 3363.391623][T11269] binder: 11268:11269 ioctl c0306201 20000040 returned -22 06:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x5000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0xffffffffffffffff}) [ 3363.473345][T11323] binder_alloc: 11303: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:06 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xffffff7f}, 0x0) 06:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xf}}, 0x0) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03', 0x0, 0xffffffffffffffff}) 06:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x300000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406306, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04', 0x0, 0xffffffffffffffff}) [ 3363.764134][T11796] binder: BINDER_SET_CONTEXT_MGR already set [ 3363.775319][T11796] binder: 11726:11796 ioctl 40046207 0 returned -16 06:14:06 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xffffff9e}, 0x0) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05', 0x0, 0xffffffffffffffff}) [ 3363.854811][T11932] binder: 11745:11932 unknown command 1077961478 [ 3363.894936][T11932] binder: 11745:11932 ioctl c0306201 20000040 returned -22 06:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0x30}}, 0x0) 06:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x1000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06', 0x0, 0xffffffffffffffff}) [ 3364.016785][T12118] binder_alloc: 12116: binder_alloc_buf failed to map page at 20002000 in userspace [ 3364.029618][T12115] binder: BINDER_SET_CONTEXT_MGR already set [ 3364.035649][T12115] binder: 12114:12115 ioctl 40046207 0 returned -16 06:14:06 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xfffffff0}, 0x0) 06:14:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xec0}}, 0x0) 06:14:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x12000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a', 0x0, 0xffffffffffffffff}) 06:14:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406307, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3364.312443][T12544] binder_alloc: 12533: binder_alloc_buf failed to map page at 20002000 in userspace [ 3364.329389][T12530] binder: BINDER_SET_CONTEXT_MGR already set [ 3364.346775][T12576] binder: 12524:12576 unknown command 1077961479 [ 3364.355872][T12530] binder: 12529:12530 ioctl 40046207 0 returned -16 06:14:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b', 0x0, 0xffffffffffffffff}) 06:14:07 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x10000000000}, 0x0) [ 3364.362703][T12576] binder: 12524:12576 ioctl c0306201 20000040 returned -22 [ 3364.392799][T12530] binder_alloc: 12533: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x20000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff11}}, 0x0) [ 3364.412753][T12576] binder: 12524:12576 unknown command 1077961479 [ 3364.470447][T12744] binder: BINDER_SET_CONTEXT_MGR already set [ 3364.500136][T12744] binder: 12741:12744 ioctl 40046207 0 returned -16 [ 3364.507459][T12576] binder: 12524:12576 ioctl c0306201 20000040 returned -22 06:14:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406312, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n', 0x0, 0xffffffffffffffff}) 06:14:07 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x40030000000000}, 0x0) 06:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff40}}, 0x0) 06:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3f000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!', 0x0, 0xffffffffffffffff}) [ 3364.707865][T13054] binder: 13050:13054 unknown command 1077961490 [ 3364.773977][T13054] binder: 13050:13054 ioctl c0306201 20000040 returned -22 [ 3364.784406][T13060] binder_alloc: 13057: binder_alloc_buf failed to map page at 20002000 in userspace [ 3364.798225][T13073] binder: BINDER_SET_CONTEXT_MGR already set [ 3364.813830][T13073] binder: 13061:13073 ioctl 40046207 0 returned -16 06:14:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B', 0x0, 0xffffffffffffffff}) 06:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0x33fe0}}, 0x0) [ 3364.840067][T13073] binder_alloc: 13057: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x48000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xf0ffffffffffff}, 0x0) 06:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406348, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00H', 0x0, 0xffffffffffffffff}) [ 3365.058276][T13521] binder_alloc: 13520: binder_alloc_buf failed to map page at 20002000 in userspace [ 3365.074782][T13544] binder: BINDER_SET_CONTEXT_MGR already set [ 3365.105470][T13544] binder: 13535:13544 ioctl 40046207 0 returned -16 06:14:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0x2000ff0e}}, 0x0) [ 3365.147602][T13580] binder: 13549:13580 unknown command 1077961544 [ 3365.170197][T13580] binder: 13549:13580 ioctl c0306201 20000040 returned -22 [ 3365.172153][T13521] binder_transaction: 15 callbacks suppressed [ 3365.172171][T13521] binder: 13520:13521 transaction failed 29201/-12, size 0-12288 line 3147 06:14:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00L', 0x0, 0xffffffffffffffff}) 06:14:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x5000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:08 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x100000000000000}, 0x0) 06:14:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h', 0x0, 0xffffffffffffffff}) [ 3365.286665][T13824] binder: BINDER_SET_CONTEXT_MGR already set [ 3365.298063][T13824] binder: 13801:13824 ioctl 40046207 0 returned -16 06:14:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0x7ffff000}}, 0x0) [ 3365.327242][T13824] binder_alloc: 13520: binder_alloc_buf failed to map pages in userspace, no vma [ 3365.350838][T13824] binder: 13801:13824 transaction failed 29189/-3, size 0-12288 line 3147 06:14:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00l', 0x0, 0xffffffffffffffff}) 06:14:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3365.447068][T14026] binder_alloc: 14019: binder_alloc_buf failed to map page at 20002000 in userspace [ 3365.468394][T14026] binder: 14019:14026 transaction failed 29201/-12, size 0-12288 line 3147 06:14:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x4040634c, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xfffffdef}}, 0x0) [ 3365.597284][T14250] binder: BINDER_SET_CONTEXT_MGR already set 06:14:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00t', 0x0, 0xffffffffffffffff}) [ 3365.638974][T14307] binder: 14248:14307 unknown command 1077961548 [ 3365.645357][T14307] binder: 14248:14307 ioctl c0306201 20000040 returned -22 [ 3365.648962][T14250] binder: 14247:14250 ioctl 40046207 0 returned -16 06:14:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x60000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:08 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x200000000000000}, 0x0) [ 3365.756745][T14382] binder_alloc: 14364: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00z', 0x0, 0xffffffffffffffff}) [ 3365.808662][T14382] binder: 14364:14382 transaction failed 29201/-12, size 0-12288 line 3147 06:14:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:08 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x300000000000000}, 0x0) 06:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x2}, 0x0) 06:14:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbf', 0x0, 0xffffffffffffffff}) [ 3365.995468][T14709] binder: BINDER_SET_CONTEXT_MGR already set 06:14:08 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x400000000000000}, 0x0) 06:14:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x68000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406360, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3366.052720][T14709] binder: 14653:14709 ioctl 40046207 0 returned -16 06:14:08 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x3}, 0x0) 06:14:08 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd', 0x0, 0xffffffffffffffff}) [ 3366.195451][T14877] binder_alloc: 14852: binder_alloc_buf failed to map page at 20002000 in userspace [ 3366.229697][T14877] binder: 14852:14877 transaction failed 29201/-12, size 0-12288 line 3147 [ 3366.229998][T14922] binder: 14881:14922 unknown command 1077961568 [ 3366.246975][T14922] binder: 14881:14922 ioctl c0306201 20000040 returned -22 06:14:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xa000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x5}, 0x0) 06:14:09 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x700000000000000}, 0x0) 06:14:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3366.400375][T15234] binder: BINDER_SET_CONTEXT_MGR already set 06:14:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406368, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3366.468880][T15234] binder: 15216:15234 ioctl 40046207 0 returned -16 [ 3366.493882][T15294] binder_alloc: 15279: binder_alloc_buf failed to map page at 20002000 in userspace [ 3366.533992][T15294] binder: 15279:15294 transaction failed 29201/-12, size 0-12288 line 3147 06:14:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x8}, 0x0) 06:14:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x12000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3366.587314][T15440] binder: 15422:15440 unknown command 1077961576 [ 3366.593700][T15440] binder: 15422:15440 ioctl c0306201 20000040 returned -22 06:14:09 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xa00000000000000}, 0x0) 06:14:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x74000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3366.709982][T15612] binder: BINDER_SET_CONTEXT_MGR already set [ 3366.725967][T15612] binder: 15608:15612 ioctl 40046207 0 returned -16 [ 3366.749828][T15612] binder_alloc: 15279: binder_alloc_buf, no vma 06:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x11}, 0x0) [ 3366.796140][T15612] binder: 15608:15612 transaction failed 29189/-3, size 0-12288 line 3147 [ 3366.817321][T15741] binder_alloc: 15725: binder_alloc_buf failed to map page at 20002000 in userspace [ 3366.836131][T15741] binder: 15725:15741 transaction failed 29201/-12, size 0-12288 line 3147 06:14:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x4040636c, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:09 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xe00000000000000}, 0x0) 06:14:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x20000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x300}, 0x0) [ 3367.120121][T16096] binder: 16095:16096 unknown command 1077961580 [ 3367.157820][T16096] binder: 16095:16096 ioctl c0306201 20000040 returned -22 06:14:09 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3367.190657][T16145] binder_alloc: 16137: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:09 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0xffffff1f}, 0x0) [ 3367.239027][T16145] binder: 16137:16145 transaction failed 29201/-12, size 0-12288 line 3147 06:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x48000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:10 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x3d59000000000000}, 0x0) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3367.379412][T16503] binder: BINDER_SET_CONTEXT_MGR already set [ 3367.410620][T16503] binder: 16495:16503 ioctl 40046207 0 returned -16 06:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xfdfdffff]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406374, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x2}, 0x0) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3367.602592][T16764] binder_alloc: 16757: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x3}, 0x0) [ 3367.642906][T16764] binder: 16757:16764 transaction failed 29201/-12, size 0-12288 line 3147 [ 3367.667454][T16820] binder: 16760:16820 unknown command 1077961588 [ 3367.673834][T16820] binder: 16760:16820 ioctl c0306201 20000040 returned -22 06:14:10 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x6000000000000000}, 0x0) [ 3367.716212][T16835] binder: BINDER_SET_CONTEXT_MGR already set [ 3367.735148][T16835] binder: 16834:16835 ioctl 40046207 0 returned -16 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x60000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xfffffdfd]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x4}, 0x0) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x4040637a, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3367.993188][T17237] binder_alloc: 17236: binder_alloc_buf failed to map page at 20002000 in userspace [ 3368.004214][T17246] binder: BINDER_SET_CONTEXT_MGR already set [ 3368.029510][T17246] binder: 17238:17246 ioctl 40046207 0 returned -16 06:14:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x30000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3368.082447][T17246] binder_alloc: 17236: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:10 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x6}, 0x0) 06:14:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3368.176950][T17463] binder: 17462:17463 unknown command 1077961594 [ 3368.219748][T17463] binder: 17462:17463 ioctl c0306201 20000040 returned -22 06:14:10 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x9effffff00000000}, 0x0) 06:14:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x100000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x68000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:11 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xa}, 0x0) [ 3368.413678][T17838] binder_alloc: 17836: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406400, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:11 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xc00e000000000000}, 0x0) [ 3368.482506][T17889] binder: BINDER_SET_CONTEXT_MGR already set [ 3368.513166][T17889] binder: 17886:17889 ioctl 40046207 0 returned -16 06:14:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x200000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3368.590411][T18044] binder: 17979:18044 unknown command 1077961728 [ 3368.608088][T18044] binder: 17979:18044 ioctl c0306201 20000040 returned -22 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:11 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xc}, 0x0) [ 3368.682322][T18211] binder_alloc: 18210: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x300000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3368.818347][T18399] binder: BINDER_SET_CONTEXT_MGR already set 06:14:11 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xf0ffffff00000000}, 0x0) [ 3368.864542][T18399] binder: 18389:18399 ioctl 40046207 0 returned -16 [ 3368.907683][T18487] binder_alloc: 18486: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:11 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xe}, 0x0) 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406800, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x74000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:11 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf}, 0x0) 06:14:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x400000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3369.141240][T18843] binder: 18842:18843 unknown command 1077962752 [ 3369.171566][T18849] binder: BINDER_SET_CONTEXT_MGR already set 06:14:11 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3369.185619][T18843] binder: 18842:18843 ioctl c0306201 20000040 returned -22 [ 3369.210417][T18849] binder: 18847:18849 ioctl 40046207 0 returned -16 06:14:11 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xffffff7f00000000}, 0x0) [ 3369.233548][T18869] binder_alloc: 18864: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x10}, 0x0) 06:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x500000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0xfffffffffffff000}, 0x0) [ 3369.489306][T19285] binder_transaction: 3 callbacks suppressed [ 3369.489317][T19285] binder: 19284:19285 got transaction with invalid offsets ptr [ 3369.512947][T19296] binder: BINDER_SET_CONTEXT_MGR already set 06:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406900, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3369.541210][T19296] binder: 19292:19296 ioctl 40046207 0 returned -16 [ 3369.550201][T19296] binder: 19292:19296 got transaction with invalid offsets ptr 06:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x60}, 0x0) 06:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x600000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3369.684028][T19560] binder: 19534:19560 unknown command 1077963008 [ 3369.702104][T19560] binder: 19534:19560 ioctl c0306201 20000040 returned -22 06:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xfdfdffff]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3369.783946][T19625] binder_alloc: 19623: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:12 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x2}, 0x0) 06:14:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf0}, 0x0) [ 3369.838201][T19710] binder: BINDER_SET_CONTEXT_MGR already set [ 3369.852541][T19710] binder: 19704:19710 ioctl 40046207 0 returned -16 06:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x700000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:12 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x3}, 0x0) [ 3370.028565][T20048] binder_alloc: 20043: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406c00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xfffffdfd]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:12 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x300}, 0x0) 06:14:12 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x4}, 0x0) [ 3370.140123][T20215] binder: BINDER_SET_CONTEXT_MGR already set 06:14:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x1200000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3370.184026][T20230] binder: 20227:20230 unknown command 1077963776 [ 3370.199523][T20230] binder: 20227:20230 ioctl c0306201 20000040 returned -22 [ 3370.203096][T20215] binder: 20214:20215 ioctl 40046207 0 returned -16 [ 3370.266181][T20308] binder_alloc: 20258: binder_alloc_buf failed to map page at 20002000 in userspace [ 3370.305636][T20308] binder_transaction: 10 callbacks suppressed 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x7}, 0x0) [ 3370.305655][T20308] binder: 20258:20308 transaction failed 29201/-12, size 0-12288 line 3147 06:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x30000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xa}, 0x0) 06:14:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x600}, 0x0) 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3370.425119][T20588] binder: BINDER_SET_CONTEXT_MGR already set [ 3370.462154][T20588] binder: 20586:20588 ioctl 40046207 0 returned -16 06:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406f00, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2000000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xe}, 0x0) 06:14:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xa00}, 0x0) [ 3370.590952][T20830] binder_alloc: 20829: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3370.631340][T20830] binder: 20829:20830 transaction failed 29201/-12, size 0-12288 line 3147 06:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x100000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x60}, 0x0) [ 3370.691629][T20868] binder: 20855:20868 unknown command 1077964544 [ 3370.724538][T20868] binder: 20855:20868 ioctl c0306201 20000040 returned -22 [ 3370.753241][T20930] binder: BINDER_SET_CONTEXT_MGR already set 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x3f00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3370.793801][T20930] binder: 20910:20930 ioctl 40046207 0 returned -16 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xf0}, 0x0) 06:14:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xc00}, 0x0) 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3370.929540][T21221] binder_alloc: 21220: binder_alloc_buf failed to map page at 20002000 in userspace [ 3370.965976][T21221] binder: 21220:21221 transaction failed 29201/-12, size 0-12288 line 3147 06:14:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40407000, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x200000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x300}, 0x0) 06:14:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xe00}, 0x0) 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3371.070086][T21458] binder: BINDER_SET_CONTEXT_MGR already set [ 3371.093063][T21458] binder: 21457:21458 ioctl 40046207 0 returned -16 06:14:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4800000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:13 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x700}, 0x0) [ 3371.133842][T21498] binder: 21490:21498 unknown command 1077964800 [ 3371.162193][T21498] binder: 21490:21498 ioctl c0306201 20000040 returned -22 06:14:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:13 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf00}, 0x0) 06:14:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x300000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3371.266676][T21732] binder_alloc: 21730: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xa00}, 0x0) 06:14:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff', 0x0, 0xffffffffffffffff}) [ 3371.332184][T21732] binder: 21730:21732 transaction failed 29201/-12, size 0-12288 line 3147 [ 3371.354349][T21797] binder: BINDER_SET_CONTEXT_MGR already set [ 3371.389228][T21797] binder: 21778:21797 ioctl 40046207 0 returned -16 06:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x5865}, 0x0) 06:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40407300, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x400000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xe00}, 0x0) 06:14:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd', 0x0, 0xffffffffffffffff}) [ 3371.621853][T22196] binder: 22183:22196 unknown command 1077965568 [ 3371.633425][T22250] binder_alloc: 22229: binder_alloc_buf failed to map page at 20002000 in userspace [ 3371.634935][T22196] binder: 22183:22196 ioctl c0306201 20000040 returned -22 [ 3371.652295][T22258] binder: BINDER_SET_CONTEXT_MGR already set 06:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x58af}, 0x0) 06:14:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xec0}, 0x0) 06:14:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3371.674643][T22258] binder: 22243:22258 ioctl 40046207 0 returned -16 [ 3371.681949][T22250] binder: 22229:22250 transaction failed 29201/-12, size 0-12288 line 3147 06:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x6000}, 0x0) 06:14:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x3d59}, 0x0) 06:14:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x500000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40407500, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6000000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3371.951002][T22607] binder_alloc: 22605: binder_alloc_buf failed to map page at 20002000 in userspace [ 3371.962273][T22602] binder: BINDER_SET_CONTEXT_MGR already set [ 3371.974336][T22613] binder: 22612:22613 unknown command 1077966080 [ 3371.984177][T22602] binder: 22601:22602 ioctl 40046207 0 returned -16 [ 3371.994039][T22613] binder: 22612:22613 ioctl c0306201 20000040 returned -22 06:14:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x593d}, 0x0) 06:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x6558}, 0x0) [ 3372.001523][T22607] binder: 22605:22607 transaction failed 29201/-12, size 0-12288 line 3147 [ 3372.006248][T22602] binder_alloc: 22605: binder_alloc_buf failed to map page at 20002000 in userspace [ 3372.026467][T22602] binder: 22601:22602 transaction failed 29201/-12, size 0-12288 line 3147 06:14:14 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x6000}, 0x0) 06:14:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6800000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x600000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:14 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x8100}, 0x0) 06:14:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40407800, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3372.243879][T23135] binder_alloc: 23134: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xc00e}, 0x0) 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3372.304619][T23135] binder: 23134:23135 transaction failed 29201/-12, size 0-12288 line 3147 [ 3372.332008][T23138] binder: BINDER_SET_CONTEXT_MGR already set 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xf000}, 0x0) [ 3372.364327][T23138] binder: 23137:23138 ioctl 40046207 0 returned -16 [ 3372.365271][T23142] binder: 23141:23142 unknown command 1077966848 [ 3372.404367][T23142] binder: 23141:23142 ioctl c0306201 20000040 returned -22 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:15 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xaf58}, 0x0) 06:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x700000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40486311, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3372.691418][T23573] binder_alloc: 23571: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x34000}, 0x0) [ 3372.733087][T23604] binder: BINDER_SET_CONTEXT_MGR already set [ 3372.743695][T23582] binder_alloc: 23571: binder_alloc_buf failed to map page at 20002000 in userspace [ 3372.753710][T23573] binder: 23571:23573 transaction failed 29201/-12, size 0-12288 line 3147 [ 3372.753735][T23604] binder: 23586:23604 ioctl 40046207 0 returned -16 [ 3372.793150][T23582] binder: 23579:23582 transaction failed 29201/-12, size 0-12288 line 3147 06:14:15 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xdefe}, 0x0) 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x400300}, 0x0) 06:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7400000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xa00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xf0ffff}, 0x0) [ 3372.996235][T24032] binder_alloc: 24012: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:15 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf000}, 0x0) 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3373.060423][T24111] binder: BINDER_SET_CONTEXT_MGR already set 06:14:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40486312, {0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x1000000}, 0x0) [ 3373.119363][T24111] binder: 24089:24111 ioctl 40046207 0 returned -16 06:14:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3373.176564][T24237] binder: 24227:24237 got reply transaction with no transaction stack 06:14:15 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x2000000}, 0x0) 06:14:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x1200000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x3000000}, 0x0) 06:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xfede}, 0x0) [ 3373.345053][T24498] binder_alloc: 24494: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x2, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3373.457530][T24582] binder: BINDER_SET_CONTEXT_MGR already set 06:14:16 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x4000000}, 0x0) 06:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x8000000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3373.501472][T24582] binder: 24581:24582 ioctl 40046207 0 returned -16 [ 3373.568904][T24801] binder: 24756:24801 got transaction to invalid handle 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x34000}, 0x0) [ 3373.612026][T24853] binder_alloc: 24849: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:16 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x7000000}, 0x0) 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x2000000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x3, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xfdfdffff00000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xa000000}, 0x0) 06:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x400300}, 0x0) [ 3373.809671][T25171] binder: BINDER_SET_CONTEXT_MGR already set 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3373.873959][T25171] binder: 25117:25171 ioctl 40046207 0 returned -16 [ 3373.907007][T25202] binder_alloc: 25187: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3373.964088][T25238] binder: 25219:25238 got transaction to invalid handle 06:14:16 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xe000000}, 0x0) 06:14:16 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf0ffff}, 0x0) 06:14:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4800000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xffffffff00000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3374.169785][T25601] binder_alloc: 25597: binder_alloc_buf failed to map page at 20002000 in userspace [ 3374.183776][T25608] binder: BINDER_SET_CONTEXT_MGR already set [ 3374.196390][T25608] binder: 25604:25608 ioctl 40046207 0 returned -16 06:14:16 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x3d590000}, 0x0) 06:14:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3374.230172][T25608] binder_alloc: 25597: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x1000000}, 0x0) 06:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2, &(0x7f0000000300)}) 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x60000000}, 0x0) [ 3374.342663][T25871] binder: 25845:25871 got transaction to invalid handle 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x9effffff}, 0x0) [ 3374.410607][T25973] binder_alloc: 25902: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x4c00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x2000000}, 0x0) 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xc00e0000}, 0x0) [ 3374.597719][T26226] binder: BINDER_SET_CONTEXT_MGR already set 06:14:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x5, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3, &(0x7f0000000300)}) [ 3374.639444][T26226] binder: 26221:26226 ioctl 40046207 0 returned -16 06:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x3000000}, 0x0) 06:14:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6000000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3374.761146][T26428] binder_alloc: 26413: binder_alloc_buf failed to map page at 20002000 in userspace [ 3374.777660][T26427] binder: 26364:26427 got transaction to invalid handle 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xf0ffffff}, 0x0) [ 3374.864169][T26483] binder: BINDER_SET_CONTEXT_MGR already set 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xfffff000}, 0x0) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3374.905238][T26483] binder: 26479:26483 ioctl 40046207 0 returned -16 06:14:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4, &(0x7f0000000300)}) 06:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x4000000}, 0x0) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6800000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xffffff7f}, 0x0) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3375.114254][T26888] binder_alloc: 26886: binder_alloc_buf failed to map page at 20002000 in userspace [ 3375.134857][T26896] binder: BINDER_SET_CONTEXT_MGR already set [ 3375.157633][T26896] binder: 26895:26896 ioctl 40046207 0 returned -16 06:14:17 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xffffff9e}, 0x0) 06:14:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x6000000}, 0x0) [ 3375.262731][T27021] binder: 26941:27021 got transaction to invalid handle 06:14:18 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xfffffff0}, 0x0) 06:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x6c00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x5, &(0x7f0000000300)}) 06:14:18 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x10000000000}, 0x0) [ 3375.412257][T27227] binder_alloc: 27226: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3375.479372][T27312] binder: BINDER_SET_CONTEXT_MGR already set [ 3375.485548][T27312] binder: 27269:27312 ioctl 40046207 0 returned -16 [ 3375.494449][T27312] binder_alloc: 27226: binder_alloc_buf failed to map page at 20002000 in userspace [ 3375.494475][T27227] binder_transaction: 15 callbacks suppressed [ 3375.494494][T27227] binder: 27226:27227 transaction failed 29201/-12, size 0-12288 line 3147 [ 3375.516691][T27312] binder: 27269:27312 transaction failed 29201/-12, size 0-12288 line 3147 06:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:18 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x40030000000000}, 0x0) 06:14:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xa000000}, 0x0) 06:14:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6, &(0x7f0000000300)}) 06:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7400000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3375.738832][T27611] binder: 27556:27611 got transaction to invalid handle [ 3375.789664][T27611] binder: 27556:27611 transaction failed 29201/-22, size 0-12288 line 2994 [ 3375.801866][T27693] binder_alloc: 27664: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:18 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0) [ 3375.831619][T27714] binder: BINDER_SET_CONTEXT_MGR already set [ 3375.840436][T27693] binder: 27664:27693 transaction failed 29201/-12, size 0-12288 line 3147 [ 3375.851405][T27714] binder: 27708:27714 ioctl 40046207 0 returned -16 06:14:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xc000000}, 0x0) [ 3375.876650][T27714] binder_alloc: 27664: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3375.893852][T27714] binder: 27708:27714 transaction failed 29201/-12, size 0-12288 line 3147 06:14:18 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x100000000000000}, 0x0) 06:14:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7, &(0x7f0000000300)}) [ 3376.096556][T28123] binder_alloc: 28099: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x12, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x7a00000000000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:18 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x200000000000000}, 0x0) 06:14:18 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xe000000}, 0x0) [ 3376.141031][T28123] binder: 28099:28123 transaction failed 29201/-12, size 0-12288 line 3147 06:14:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3376.228639][T28201] binder: BINDER_SET_CONTEXT_MGR already set [ 3376.255971][T28201] binder: 28197:28201 ioctl 40046207 0 returned -16 [ 3376.264137][T28222] binder: 28221:28222 got transaction to invalid handle 06:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x12, &(0x7f0000000300)}) [ 3376.296977][T28222] binder: 28221:28222 transaction failed 29201/-22, size 0-12288 line 2994 06:14:19 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3376.368457][T28379] binder_alloc: 28367: binder_alloc_buf failed to map page at 20002000 in userspace [ 3376.397106][T28379] binder: 28367:28379 transaction failed 29201/-12, size 0-12288 line 3147 06:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf000000}, 0x0) 06:14:19 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x300000000000000}, 0x0) 06:14:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0xfdfdffff00000000]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x30, &(0x7f0000000300)}) [ 3376.610479][T28733] binder: 28660:28733 got transaction with invalid offsets ptr [ 3376.629074][T28733] binder: 28660:28733 transaction failed 29201/-14, size 0-12288 line 3193 06:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x30, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:19 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x10000000}, 0x0) [ 3376.676475][T28795] binder: BINDER_SET_CONTEXT_MGR already set 06:14:19 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x400000000000000}, 0x0) 06:14:19 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3376.723720][T28795] binder: 28777:28795 ioctl 40046207 0 returned -16 06:14:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2, &(0x7f0000000300)}) [ 3376.847193][T28982] binder: 28889:28982 got transaction to invalid handle [ 3376.876606][T29081] binder: 29077:29081 got transaction with invalid offsets ptr 06:14:19 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x60000000}, 0x0) [ 3376.892497][T28982] binder: 28889:28982 transaction failed 29201/-22, size 0-12288 line 2994 06:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x48, &(0x7f0000000300)}) 06:14:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3, &(0x7f0000000300)}) [ 3377.046900][T29287] binder: BINDER_SET_CONTEXT_MGR already set [ 3377.060840][T29287] binder: 29284:29287 ioctl 40046207 0 returned -16 06:14:19 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x700000000000000}, 0x0) 06:14:19 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x65580000}, 0x0) 06:14:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x48, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:19 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c, &(0x7f0000000300)}) 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3377.279042][T29694] binder: 29671:29694 got transaction to invalid handle 06:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x81000000}, 0x0) 06:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4, &(0x7f0000000300)}) 06:14:20 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xa00000000000000}, 0x0) [ 3377.347731][T29754] binder_alloc: 29750: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4c, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3377.469347][T29849] binder: BINDER_SET_CONTEXT_MGR already set [ 3377.490496][T29849] binder: 29845:29849 ioctl 40046207 0 returned -16 [ 3377.509927][T29849] binder_alloc: 29750: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x60, &(0x7f0000000300)}) [ 3377.591289][T30007] binder: 29994:30007 got transaction to invalid handle 06:14:20 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xe00000000000000}, 0x0) 06:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x88a8ffff}, 0x0) 06:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x5, &(0x7f0000000300)}) [ 3377.689744][T30164] binder_alloc: 30163: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x60, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3377.786405][T30217] binder: BINDER_SET_CONTEXT_MGR already set [ 3377.811035][T30217] binder: 30214:30217 ioctl 40046207 0 returned -16 06:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x68, &(0x7f0000000300)}) 06:14:20 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x3d59000000000000}, 0x0) 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x9effffff}, 0x0) 06:14:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6, &(0x7f0000000300)}) 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x68, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3378.066865][T30637] binder_alloc: 30635: binder_alloc_buf failed to map page at 20002000 in userspace [ 3378.149548][T30673] binder: BINDER_SET_CONTEXT_MGR already set [ 3378.155608][T30673] binder: 30672:30673 ioctl 40046207 0 returned -16 06:14:20 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c, &(0x7f0000000300)}) 06:14:20 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x6000000000000000}, 0x0) 06:14:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xaf580000}, 0x0) [ 3378.328720][T31023] binder_alloc: 31022: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7, &(0x7f0000000300)}) 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6c, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x74, &(0x7f0000000300)}) [ 3378.462658][T31199] binder: BINDER_SET_CONTEXT_MGR already set [ 3378.474362][T31199] binder: 31196:31199 ioctl 40046207 0 returned -16 [ 3378.497787][T31199] binder_alloc: 31022: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xdefe0000}, 0x0) 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3378.560711][T31299] binder: BINDER_SET_CONTEXT_MGR already set [ 3378.590247][T31299] binder: 31297:31299 ioctl 40046207 0 returned -16 06:14:21 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x9effffff00000000}, 0x0) 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x74, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xa, &(0x7f0000000300)}) 06:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a, &(0x7f0000000300)}) 06:14:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf0ffffff}, 0x0) [ 3378.879655][T31714] binder_alloc: 31713: binder_alloc_buf failed to map page at 20002000 in userspace [ 3378.910965][T31719] binder: BINDER_SET_CONTEXT_MGR already set [ 3378.919836][T31718] binder_transaction: 3 callbacks suppressed 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:21 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xc00e000000000000}, 0x0) [ 3378.919846][T31718] binder: 31715:31718 got transaction to invalid handle [ 3378.944416][T31719] binder: 31717:31719 ioctl 40046207 0 returned -16 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:21 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xffffa888}, 0x0) 06:14:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x12, &(0x7f0000000300)}) 06:14:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x300, &(0x7f0000000300)}) 06:14:21 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7a, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3379.181897][T32129] binder: BINDER_SET_CONTEXT_MGR already set [ 3379.215941][T32129] binder: 32128:32129 ioctl 40046207 0 returned -16 [ 3379.240274][T32152] binder_alloc: 32151: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xfffff000}, 0x0) [ 3379.325267][T32349] binder: 32211:32349 got transaction to invalid handle 06:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x30, &(0x7f0000000300)}) 06:14:22 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 06:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x500, &(0x7f0000000300)}) 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3379.508588][T32503] binder_alloc: 32502: binder_alloc_buf failed to map page at 20002000 in userspace [ 3379.523754][T32511] binder: BINDER_SET_CONTEXT_MGR already set [ 3379.544363][T32511] binder: 32480:32511 ioctl 40046207 0 returned -16 [ 3379.553469][T32511] binder_alloc: 32502: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x300, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xffffff7f}, 0x0) 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x600, &(0x7f0000000300)}) [ 3379.699225][T32766] binder: 32744:32766 got transaction to invalid handle 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3379.774598][ T471] binder_alloc: 430: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x48, &(0x7f0000000300)}) 06:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xffffff9e}, 0x0) 06:14:22 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3379.922627][ T696] binder: BINDER_SET_CONTEXT_MGR already set [ 3379.956147][ T696] binder: 694:696 ioctl 40046207 0 returned -16 06:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x700, &(0x7f0000000300)}) 06:14:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x500, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:22 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xfffffff0}, 0x0) [ 3380.064562][ T860] binder_alloc: 847: binder_alloc_buf failed to map page at 20002000 in userspace [ 3380.109201][ T884] binder: 879:884 got transaction to invalid handle 06:14:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c, &(0x7f0000000300)}) 06:14:22 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x1200, &(0x7f0000000300)}) [ 3380.213850][ T1100] binder: BINDER_SET_CONTEXT_MGR already set [ 3380.230514][ T1100] binder: 1096:1100 ioctl 40046207 0 returned -16 [ 3380.241092][ T1100] binder_alloc: 847: binder_alloc_buf failed to map pages in userspace, no vma 06:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x40030000000000}, 0x0) 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3380.325211][ T1260] binder_alloc: 1250: binder_alloc_buf failed to map page at 20002000 in userspace [ 3380.338313][ T1260] binder: 1250:1260 ioctl c0306201 20000040 returned -14 06:14:23 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0xfffffffffffff000}, 0x0) 06:14:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x600, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x60, &(0x7f0000000300)}) 06:14:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2000, &(0x7f0000000300)}) 06:14:23 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x2}, 0x0) 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3380.482409][ T1484] binder: 1443:1484 got transaction to invalid handle [ 3380.516903][ T1484] binder_transaction: 26 callbacks suppressed [ 3380.516922][ T1484] binder: 1443:1484 transaction failed 29201/-22, size 0-12288 line 2994 [ 3380.577994][ T1557] binder_alloc: 1555: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf0ffffffffffff}, 0x0) 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3380.621956][ T1557] binder: 1555:1557 transaction failed 29201/-12, size 0-12288 line 3147 [ 3380.631621][ T1546] binder: BINDER_SET_CONTEXT_MGR already set [ 3380.645236][ T1557] binder: 1555:1557 ioctl c0306201 20000040 returned -14 [ 3380.647889][ T1546] binder: 1544:1546 ioctl 40046207 0 returned -16 06:14:23 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x3}, 0x0) 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x700, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3000, &(0x7f0000000300)}) 06:14:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x68, &(0x7f0000000300)}) 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3380.914540][ T2010] binder: BINDER_SET_CONTEXT_MGR already set [ 3380.951073][ T2011] binder_alloc: 1991: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x100000000000000}, 0x0) [ 3380.956685][ T2013] binder: 2012:2013 got transaction to invalid handle [ 3380.962237][ T2010] binder: 1995:2010 ioctl 40046207 0 returned -16 [ 3380.980309][ T2011] binder: 1991:2011 transaction failed 29201/-12, size 0-12288 line 3147 [ 3380.990708][ T2011] binder: 1991:2011 ioctl c0306201 20000040 returned -14 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:23 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) [ 3381.041276][ T2013] binder: 2012:2013 transaction failed 29201/-22, size 0-12288 line 2994 06:14:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c, &(0x7f0000000300)}) 06:14:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3f00, &(0x7f0000000300)}) [ 3381.193432][ T2350] binder: BINDER_SET_CONTEXT_MGR already set 06:14:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:23 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x200000000000000}, 0x0) 06:14:23 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x7}, 0x0) [ 3381.240519][ T2350] binder: 2349:2350 ioctl 40046207 0 returned -16 [ 3381.241613][ T2360] binder_alloc: 2356: binder_alloc_buf failed to map page at 20002000 in userspace [ 3381.299521][ T2360] binder: 2356:2360 transaction failed 29201/-12, size 0-12288 line 3147 06:14:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x1200, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:24 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:24 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xa}, 0x0) 06:14:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4800, &(0x7f0000000300)}) 06:14:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x74, &(0x7f0000000300)}) 06:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x300000000000000}, 0x0) [ 3381.532854][ T2765] binder: 2764:2765 got transaction with invalid offsets ptr [ 3381.587837][ T2767] binder: BINDER_SET_CONTEXT_MGR already set [ 3381.608904][ T2765] binder: 2764:2765 transaction failed 29201/-14, size 0-12288 line 3193 [ 3381.611062][ T2767] binder: 2766:2767 ioctl 40046207 0 returned -16 06:14:24 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3381.633532][ T2767] binder: 2766:2767 got transaction with invalid offsets ptr [ 3381.643216][ T2767] binder: 2766:2767 transaction failed 29201/-14, size 0-12288 line 3193 06:14:24 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xe}, 0x0) 06:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x400000000000000}, 0x0) 06:14:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c00, &(0x7f0000000300)}) 06:14:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a, &(0x7f0000000300)}) 06:14:24 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3381.878212][ T3099] binder: 3084:3099 got transaction to invalid handle [ 3381.925639][ T3099] binder: 3084:3099 transaction failed 29201/-22, size 0-12288 line 2994 [ 3381.936105][ T3199] binder_alloc: 3195: binder_alloc_buf failed to map page at 20002000 in userspace [ 3381.948185][ T3196] binder: BINDER_SET_CONTEXT_MGR already set [ 3381.966642][ T3199] binder: 3195:3199 transaction failed 29201/-12, size 0-12288 line 3147 [ 3381.976518][ T3196] binder: 3194:3196 ioctl 40046207 0 returned -16 [ 3381.989057][ T3196] binder_alloc: 3195: binder_alloc_buf failed to map page at 20002000 in userspace [ 3382.003560][ T3196] binder: 3194:3196 transaction failed 29201/-12, size 0-12288 line 3147 06:14:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x2000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x300, &(0x7f0000000300)}) 06:14:24 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x600000000000000}, 0x0) 06:14:24 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x60}, 0x0) 06:14:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6000, &(0x7f0000000300)}) 06:14:24 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:24 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3382.218252][ T3563] binder_alloc: 3561: binder_alloc_buf failed to map page at 20002000 in userspace [ 3382.232869][ T3566] binder: BINDER_SET_CONTEXT_MGR already set [ 3382.248380][ T3566] binder: 3564:3566 ioctl 40046207 0 returned -16 [ 3382.260070][ T3583] binder: 3572:3583 got transaction to invalid handle [ 3382.273989][ T3566] binder_alloc: 3561: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:25 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 06:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xa00000000000000}, 0x0) 06:14:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6800, &(0x7f0000000300)}) 06:14:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x500, &(0x7f0000000300)}) 06:14:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x3000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:25 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x300}, 0x0) 06:14:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xc00000000000000}, 0x0) [ 3382.615654][ T4096] binder: 4095:4096 got transaction with invalid offsets ptr [ 3382.617190][ T4077] binder: BINDER_SET_CONTEXT_MGR already set [ 3382.635548][ T4098] binder: 4097:4098 got transaction to invalid handle [ 3382.655948][ T4077] binder: 4072:4077 ioctl 40046207 0 returned -16 06:14:25 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x700}, 0x0) 06:14:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c00, &(0x7f0000000300)}) 06:14:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x600, &(0x7f0000000300)}) 06:14:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3382.864158][ T4457] binder: BINDER_SET_CONTEXT_MGR already set 06:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xe00000000000000}, 0x0) 06:14:25 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xa00}, 0x0) [ 3382.906169][ T4457] binder: 4431:4457 ioctl 40046207 0 returned -16 [ 3382.933291][ T4473] binder: 4469:4473 got transaction with invalid offsets ptr 06:14:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x3f00, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3383.014082][ T4571] binder: 4564:4571 got transaction to invalid handle 06:14:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7400, &(0x7f0000000300)}) 06:14:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x700, &(0x7f0000000300)}) 06:14:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:25 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf00000000000000}, 0x0) [ 3383.175812][ T4840] binder_alloc: 4835: binder_alloc_buf failed to map page at 20002000 in userspace [ 3383.217875][ T4900] binder: BINDER_SET_CONTEXT_MGR already set 06:14:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3383.264826][ T4900] binder: 4898:4900 ioctl 40046207 0 returned -16 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:26 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xe00}, 0x0) 06:14:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a00, &(0x7f0000000300)}) 06:14:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xa00, &(0x7f0000000300)}) 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x1000000000000000}, 0x0) [ 3383.477204][ T5254] binder: 5250:5254 got transaction with invalid offsets ptr [ 3383.490176][ T5280] binder: BINDER_SET_CONTEXT_MGR already set [ 3383.498702][ T5280] binder: 5257:5280 ioctl 40046207 0 returned -16 [ 3383.511107][ T5280] binder: 5257:5280 got transaction with invalid offsets ptr 06:14:26 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xec0}, 0x0) 06:14:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x1200, &(0x7f0000000300)}) 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4800, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x300000, &(0x7f0000000300)}) 06:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x6000000000000000}, 0x0) [ 3383.728290][ T5662] binder: 5640:5662 got transaction with invalid offsets ptr [ 3383.755082][ T5662] binder: 5640:5662 ioctl c0306201 20000040 returned -14 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:26 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x3d59}, 0x0) [ 3383.803637][ T5670] binder: BINDER_SET_CONTEXT_MGR already set [ 3383.834958][ T5670] binder: 5669:5670 ioctl 40046207 0 returned -16 [ 3383.848816][ T5670] binder: 5669:5670 got transaction with invalid offsets ptr 06:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x6558000000000000}, 0x0) 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2000, &(0x7f0000000300)}) 06:14:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x1000000, &(0x7f0000000300)}) 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3384.091878][ T6132] binder: 6130:6132 got transaction with invalid offsets ptr [ 3384.113001][ T6151] binder: BINDER_SET_CONTEXT_MGR already set [ 3384.120790][ T6132] binder: 6130:6132 ioctl c0306201 20000040 returned -14 06:14:26 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x593d}, 0x0) 06:14:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4c00, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3384.137640][ T6151] binder: 6148:6151 ioctl 40046207 0 returned -16 06:14:26 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3384.177870][ T6151] binder: 6148:6151 got transaction with invalid offsets ptr [ 3384.212745][ T6151] binder: 6148:6151 ioctl c0306201 20000040 returned -14 06:14:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x8100000000000000}, 0x0) 06:14:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3000, &(0x7f0000000300)}) [ 3384.287386][ T6252] binder_transaction: 2 callbacks suppressed [ 3384.287396][ T6252] binder: 6203:6252 got transaction to invalid handle 06:14:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2000000, &(0x7f0000000300)}) 06:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x88a8ffff00000000}, 0x0) [ 3384.380913][ T6504] binder: 6482:6504 got transaction with invalid offsets ptr [ 3384.418205][ T6504] binder: 6482:6504 ioctl c0306201 20000040 returned -14 06:14:27 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x6000}, 0x0) [ 3384.504072][ T6588] binder: BINDER_SET_CONTEXT_MGR already set [ 3384.514184][ T6588] binder: 6565:6588 ioctl 40046207 0 returned -16 06:14:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3384.550386][ T6588] binder: 6565:6588 ioctl c0306201 20000040 returned -14 06:14:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4800, &(0x7f0000000300)}) 06:14:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:27 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xc00e}, 0x0) 06:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x9effffff00000000}, 0x0) 06:14:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3000000, &(0x7f0000000300)}) 06:14:27 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xf000}, 0x0) [ 3384.777267][ T6976] binder: 6897:6976 got transaction to invalid handle [ 3384.809328][ T7007] binder: BINDER_SET_CONTEXT_MGR already set [ 3384.849009][ T7007] binder: 7004:7007 ioctl 40046207 0 returned -16 06:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xaf58000000000000}, 0x0) 06:14:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c00, &(0x7f0000000300)}) 06:14:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:27 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x34000}, 0x0) 06:14:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4000000, &(0x7f0000000300)}) 06:14:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6800, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xdefe000000000000}, 0x0) [ 3385.188079][ T7554] binder: BINDER_SET_CONTEXT_MGR already set [ 3385.194132][ T7554] binder: 7553:7554 ioctl 40046207 0 returned -16 06:14:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6000, &(0x7f0000000300)}) 06:14:27 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x400300}, 0x0) [ 3385.232309][ T7557] binder: 7556:7557 got transaction to invalid handle 06:14:28 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xf0ffffff00000000}, 0x0) 06:14:28 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) 06:14:28 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) 06:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x5000000, &(0x7f0000000300)}) 06:14:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6800, &(0x7f0000000300)}) 06:14:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6c00, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3385.588742][ T8123] binder_alloc: 8100: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xffffff7f00000000}, 0x0) 06:14:28 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) [ 3385.633960][ T8123] binder_transaction: 24 callbacks suppressed [ 3385.633984][ T8123] binder: 8100:8123 transaction failed 29201/-12, size 0-12288 line 3147 [ 3385.654114][ T8141] binder: 8140:8141 got transaction to invalid handle [ 3385.677914][ T8144] binder: BINDER_SET_CONTEXT_MGR already set 06:14:28 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff}) [ 3385.682715][ T8141] binder: 8140:8141 transaction failed 29201/-22, size 0-12288 line 2994 [ 3385.709338][ T8144] binder: 8143:8144 ioctl 40046207 0 returned -16 06:14:28 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 3385.747332][ T8123] binder: 8100:8123 ioctl c0306201 20000040 returned -14 06:14:28 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x2, 0xffffffffffffffff}) 06:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xffffffff00000000}, 0x0) 06:14:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c00, &(0x7f0000000300)}) 06:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6000000, &(0x7f0000000300)}) 06:14:28 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x3, 0xffffffffffffffff}) [ 3385.964249][ T8541] binder_alloc: 8540: binder_alloc_buf failed to map page at 20002000 in userspace [ 3385.978365][ T8566] binder: BINDER_SET_CONTEXT_MGR already set [ 3385.984392][ T8566] binder: 8556:8566 ioctl 40046207 0 returned -16 [ 3385.999222][ T8541] binder: 8540:8541 transaction failed 29201/-12, size 0-12288 line 3147 06:14:28 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4, 0xffffffffffffffff}) 06:14:28 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) [ 3386.009283][ T8566] binder_alloc: 8540: binder_alloc_buf failed to map page at 20002000 in userspace [ 3386.015196][ T8541] binder: 8540:8541 ioctl c0306201 20000040 returned -14 [ 3386.033808][ T8566] binder: 8556:8566 transaction failed 29201/-12, size 0-12288 line 3147 06:14:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7400, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0xfffffffffffff000}, 0x0) 06:14:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7400, &(0x7f0000000300)}) 06:14:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7000000, &(0x7f0000000300)}) [ 3386.237627][ T8941] binder: 8934:8941 got transaction to invalid handle [ 3386.274988][ T8941] binder: 8934:8941 transaction failed 29201/-22, size 0-12288 line 2994 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x5, 0xffffffffffffffff}) [ 3386.293276][ T8980] binder: 8977:8980 transaction failed 29201/-14, size 0-12288 line 3193 [ 3386.319423][ T9017] binder: BINDER_SET_CONTEXT_MGR already set [ 3386.325665][ T9017] binder: 8991:9017 ioctl 40046207 0 returned -16 06:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x2}, 0x0) [ 3386.351950][ T9017] binder: 8991:9017 transaction failed 29201/-14, size 0-12288 line 3193 06:14:29 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6, 0xffffffffffffffff}) 06:14:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a00, &(0x7f0000000300)}) [ 3386.429503][ T9017] binder: 8991:9017 ioctl c0306201 20000040 returned -14 06:14:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x12000000, &(0x7f0000000300)}) [ 3386.545654][ T9438] binder: 9408:9438 transaction failed 29201/-14, size 0-12288 line 3193 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7, 0xffffffffffffffff}) 06:14:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7a00, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:29 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x7000000}, 0x0) 06:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x3}, 0x0) [ 3386.664309][ T9578] binder: BINDER_SET_CONTEXT_MGR already set [ 3386.697994][ T9578] binder: 9567:9578 ioctl 40046207 0 returned -16 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x8, 0xffffffffffffffff}) 06:14:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x300000, &(0x7f0000000300)}) [ 3386.735566][ T9655] binder: 9600:9655 got transaction to invalid handle [ 3386.745997][ T9578] binder_transaction: 7 callbacks suppressed [ 3386.746008][ T9578] binder: 9567:9578 got transaction with invalid offsets ptr [ 3386.760143][ T9655] binder: 9600:9655 transaction failed 29201/-22, size 0-12288 line 2994 06:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x4}, 0x0) [ 3386.802711][ T9578] binder: 9567:9578 transaction failed 29201/-14, size 0-12288 line 3193 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xa, 0xffffffffffffffff}) [ 3386.873708][ T9757] binder: 9753:9757 got transaction with invalid offsets ptr [ 3386.884090][ T9578] binder: 9567:9578 ioctl c0306201 20000040 returned -14 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x21, 0xffffffffffffffff}) 06:14:29 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) 06:14:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x300000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x6}, 0x0) 06:14:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x20000000, &(0x7f0000000300)}) 06:14:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x1000000, &(0x7f0000000300)}) [ 3387.105169][T10147] binder: 10146:10147 got transaction to invalid handle 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x42, 0xffffffffffffffff}) [ 3387.170159][T10162] binder: BINDER_SET_CONTEXT_MGR already set [ 3387.194414][T10162] binder: 10161:10162 ioctl 40046207 0 returned -16 [ 3387.202465][T10165] binder_alloc: 10164: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:29 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xe000000}, 0x0) 06:14:29 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x48, 0xffffffffffffffff}) [ 3387.241057][T10165] binder: 10164:10165 ioctl c0306201 20000040 returned -14 06:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xa}, 0x0) 06:14:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x1000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2000000, &(0x7f0000000300)}) 06:14:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3f000000, &(0x7f0000000300)}) [ 3387.439976][T10625] binder: BINDER_SET_CONTEXT_MGR already set [ 3387.479956][T10625] binder: 10624:10625 ioctl 40046207 0 returned -16 06:14:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4c, 0xffffffffffffffff}) [ 3387.487931][T10653] binder: 10582:10653 got transaction to invalid handle 06:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xc}, 0x0) [ 3387.528219][T10682] binder_alloc: 10680: binder_alloc_buf failed to map page at 20002000 in userspace [ 3387.554503][T10682] binder: 10680:10682 ioctl c0306201 20000040 returned -14 06:14:30 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x3d590000}, 0x0) 06:14:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x68, 0xffffffffffffffff}) 06:14:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3000000, &(0x7f0000000300)}) 06:14:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x2000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xe}, 0x0) 06:14:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x48000000, &(0x7f0000000300)}) 06:14:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6c, 0xffffffffffffffff}) [ 3387.770842][T11089] binder: BINDER_SET_CONTEXT_MGR already set [ 3387.802305][T11089] binder: 11088:11089 ioctl 40046207 0 returned -16 [ 3387.828884][T11094] binder: 11093:11094 got transaction to invalid handle 06:14:30 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) [ 3387.872604][T11129] binder_alloc: 11128: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x74, 0xffffffffffffffff}) [ 3387.912955][T11129] binder: 11128:11129 ioctl c0306201 20000040 returned -14 06:14:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4000000, &(0x7f0000000300)}) 06:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf}, 0x0) 06:14:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7a, 0xffffffffffffffff}) 06:14:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x3000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c000000, &(0x7f0000000300)}) [ 3388.094732][T11514] binder: BINDER_SET_CONTEXT_MGR already set [ 3388.125653][T11514] binder: 11512:11514 ioctl 40046207 0 returned -16 06:14:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xbf, 0xffffffffffffffff}) 06:14:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x10}, 0x0) [ 3388.195412][T11634] binder: 11578:11634 got transaction to invalid handle [ 3388.222221][T11653] binder_alloc: 11637: binder_alloc_buf failed to map page at 20002000 in userspace [ 3388.232463][T11653] binder: 11637:11653 ioctl c0306201 20000040 returned -14 06:14:30 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0) 06:14:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x5000000, &(0x7f0000000300)}) 06:14:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x60000000, &(0x7f0000000300)}) 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfd, 0xffffffffffffffff}) [ 3388.391922][T11927] binder: BINDER_SET_CONTEXT_MGR already set [ 3388.402847][T11927] binder: 11926:11927 ioctl 40046207 0 returned -16 [ 3388.425628][T11927] binder: 11926:11927 ioctl c0306201 20000040 returned -14 06:14:31 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xc00e0000}, 0x0) [ 3388.468628][T11968] binder_alloc: 11967: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x60}, 0x0) 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x300, 0xffffffffffffffff}) [ 3388.514658][T11968] binder: 11967:11968 ioctl c0306201 20000040 returned -14 06:14:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6000000, &(0x7f0000000300)}) 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x500, 0xffffffffffffffff}) 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x600, 0xffffffffffffffff}) 06:14:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x68000000, &(0x7f0000000300)}) 06:14:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf0}, 0x0) [ 3388.708632][T12340] binder: BINDER_SET_CONTEXT_MGR already set [ 3388.738784][T12340] binder: 12318:12340 ioctl 40046207 0 returned -16 06:14:31 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) [ 3388.786677][T12340] binder: 12318:12340 ioctl c0306201 20000040 returned -14 [ 3388.822169][T12402] binder_alloc: 12400: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x700, 0xffffffffffffffff}) [ 3388.895409][T12402] binder: 12400:12402 ioctl c0306201 20000040 returned -14 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xa00, 0xffffffffffffffff}) 06:14:31 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 06:14:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7000000, &(0x7f0000000300)}) 06:14:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x300}, 0x0) [ 3389.061328][T12778] binder: BINDER_SET_CONTEXT_MGR already set [ 3389.100786][T12778] binder: 12777:12778 ioctl 40046207 0 returned -16 06:14:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x5000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x2100, 0xffffffffffffffff}) 06:14:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c000000, &(0x7f0000000300)}) 06:14:31 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 06:14:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4200, 0xffffffffffffffff}) 06:14:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xa000000, &(0x7f0000000300)}) [ 3389.188624][T12869] binder_alloc: 12864: binder_alloc_buf failed to map page at 20002000 in userspace [ 3389.209857][T12869] binder: 12864:12869 ioctl c0306201 20000040 returned -14 06:14:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x600}, 0x0) 06:14:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4800, 0xffffffffffffffff}) 06:14:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x74000000, &(0x7f0000000300)}) [ 3389.373757][T13111] binder: BINDER_SET_CONTEXT_MGR already set [ 3389.402659][T13111] binder: 13100:13111 ioctl 40046207 0 returned -16 06:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xa00}, 0x0) 06:14:32 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) 06:14:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4c00, 0xffffffffffffffff}) [ 3389.513773][T13325] binder_alloc: 13319: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3389.554240][T13325] binder: 13319:13325 ioctl c0306201 20000040 returned -14 06:14:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x12000000, &(0x7f0000000300)}) [ 3389.673006][T13532] binder: BINDER_SET_CONTEXT_MGR already set [ 3389.695962][T13532] binder: 13497:13532 ioctl 40046207 0 returned -16 [ 3389.701933][T13617] binder_transaction: 2 callbacks suppressed [ 3389.701943][T13617] binder: 13567:13617 got transaction to invalid handle 06:14:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6800, 0xffffffffffffffff}) 06:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xc00}, 0x0) 06:14:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a000000, &(0x7f0000000300)}) [ 3389.715704][T13532] binder_alloc: 13319: binder_alloc_buf failed to map pages in userspace, no vma [ 3389.725227][T13532] binder: 13497:13532 ioctl c0306201 20000040 returned -14 [ 3389.810571][T13713] binder_alloc: 13710: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:32 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 06:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xe00}, 0x0) 06:14:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x20000000, &(0x7f0000000300)}) [ 3389.870346][T13713] binder: 13710:13713 ioctl c0306201 20000040 returned -14 06:14:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6c00, 0xffffffffffffffff}) 06:14:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3390.016037][T14012] binder: BINDER_SET_CONTEXT_MGR already set [ 3390.026897][T14012] binder: 14000:14012 ioctl 40046207 0 returned -16 06:14:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xfdfdffff, &(0x7f0000000300)}) 06:14:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7400, 0xffffffffffffffff}) [ 3390.068646][T14012] binder_alloc: 13710: binder_alloc_buf failed to map pages in userspace, no vma [ 3390.079948][T14076] binder: 14068:14076 got transaction to invalid handle [ 3390.109636][T14012] binder: 14000:14012 ioctl c0306201 20000040 returned -14 06:14:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf00}, 0x0) 06:14:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7a00, 0xffffffffffffffff}) [ 3390.164489][T14179] binder_alloc: 14167: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:32 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x10000000000}, 0x0) [ 3390.224092][T14179] binder: 14167:14179 ioctl c0306201 20000040 returned -14 06:14:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x48000000, &(0x7f0000000300)}) 06:14:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x12000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xbf00, 0xffffffffffffffff}) 06:14:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xfffffdfd, &(0x7f0000000300)}) [ 3390.414309][T14529] binder: 14504:14529 got transaction to invalid handle 06:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x5865}, 0x0) 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfd00, 0xffffffffffffffff}) [ 3390.487970][T14560] binder: 14558:14560 got transaction with invalid offsets ptr [ 3390.515159][T14568] binder: BINDER_SET_CONTEXT_MGR already set [ 3390.524250][T14560] binder: 14558:14560 ioctl c0306201 20000040 returned -14 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x1000000, 0xffffffffffffffff}) [ 3390.544717][T14568] binder: 14567:14568 ioctl 40046207 0 returned -16 06:14:33 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x40030000000000}, 0x0) 06:14:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c000000, &(0x7f0000000300)}) 06:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x58af}, 0x0) 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x2000000, 0xffffffffffffffff}) 06:14:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x30000000000000, &(0x7f0000000300)}) 06:14:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x20000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3390.751181][T14960] binder: 14953:14960 got transaction with invalid offsets ptr [ 3390.782070][T14960] binder_transaction: 25 callbacks suppressed [ 3390.782088][T14960] binder: 14953:14960 transaction failed 29201/-14, size 0-12288 line 3193 [ 3390.823042][T14981] binder: BINDER_SET_CONTEXT_MGR already set [ 3390.841185][T14981] binder: 14978:14981 ioctl 40046207 0 returned -16 [ 3390.849550][T14960] binder: 14953:14960 ioctl c0306201 20000040 returned -14 [ 3390.858370][T14999] binder: 14986:14999 got transaction to invalid handle 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x3000000, 0xffffffffffffffff}) 06:14:33 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0) [ 3390.871305][T14999] binder: 14986:14999 transaction failed 29201/-22, size 0-12288 line 2994 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4000000, 0xffffffffffffffff}) 06:14:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x100000000000000, &(0x7f0000000300)}) 06:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x6000}, 0x0) 06:14:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x60000000, &(0x7f0000000300)}) 06:14:33 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x5000000, 0xffffffffffffffff}) 06:14:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x3f000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3391.065983][T15377] binder: BINDER_SET_CONTEXT_MGR already set [ 3391.096431][T15377] binder: 15376:15377 ioctl 40046207 0 returned -16 [ 3391.146630][T15467] binder: 15444:15467 got transaction with invalid offsets ptr [ 3391.175611][T15467] binder: 15444:15467 transaction failed 29201/-14, size 0-12288 line 3193 06:14:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6000000, 0xffffffffffffffff}) 06:14:33 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x6558}, 0x0) [ 3391.219443][T15467] binder: 15444:15467 ioctl c0306201 20000040 returned -14 [ 3391.226737][T15578] binder: 15545:15578 got transaction to invalid handle [ 3391.226757][T15578] binder: 15545:15578 transaction failed 29201/-22, size 0-12288 line 2994 06:14:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x200000000000000, &(0x7f0000000300)}) [ 3391.328489][T15695] binder: BINDER_SET_CONTEXT_MGR already set [ 3391.347252][T15695] binder: 15694:15695 ioctl 40046207 0 returned -16 [ 3391.372955][T15695] binder: 15694:15695 got transaction with invalid offsets ptr 06:14:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x40000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:34 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7000000, 0xffffffffffffffff}) 06:14:34 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) [ 3391.402236][T15695] binder: 15694:15695 transaction failed 29201/-14, size 0-12288 line 3193 [ 3391.424576][T15695] binder: 15694:15695 ioctl c0306201 20000040 returned -14 06:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x8100}, 0x0) 06:14:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x68000000, &(0x7f0000000300)}) [ 3391.539170][T15977] binder: 15903:15977 got transaction to invalid handle 06:14:34 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x8000000, 0xffffffffffffffff}) [ 3391.582948][T15977] binder: 15903:15977 transaction failed 29201/-22, size 0-12288 line 2994 06:14:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x300000000000000, &(0x7f0000000300)}) 06:14:34 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x300000000000000}, 0x0) 06:14:34 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xa000000, 0xffffffffffffffff}) [ 3391.682264][T16143] binder: 16141:16143 got transaction with invalid offsets ptr [ 3391.698538][T16169] binder: BINDER_SET_CONTEXT_MGR already set [ 3391.711855][T16169] binder: 16157:16169 ioctl 40046207 0 returned -16 06:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xaf58}, 0x0) [ 3391.726307][T16143] binder: 16141:16143 transaction failed 29201/-14, size 0-12288 line 3193 [ 3391.758437][T16143] binder: 16141:16143 ioctl c0306201 20000040 returned -14 [ 3391.766655][T16169] binder: 16157:16169 got transaction with invalid offsets ptr [ 3391.786986][T16169] binder: 16157:16169 transaction failed 29201/-14, size 0-12288 line 3193 [ 3391.804529][T16169] binder: 16157:16169 ioctl c0306201 20000040 returned -14 06:14:34 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x21000000, 0xffffffffffffffff}) 06:14:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x48000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:34 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) 06:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xdefe}, 0x0) 06:14:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c000000, &(0x7f0000000300)}) 06:14:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x400000000000000, &(0x7f0000000300)}) 06:14:34 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x42000000, 0xffffffffffffffff}) [ 3392.129942][T16571] binder: 16566:16571 got transaction with invalid offsets ptr [ 3392.149193][T16571] binder: 16566:16571 transaction failed 29201/-14, size 0-12288 line 3193 [ 3392.160498][T16564] binder: BINDER_SET_CONTEXT_MGR already set [ 3392.166760][T16571] binder: 16566:16571 ioctl c0306201 20000040 returned -14 06:14:34 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x48000000, 0xffffffffffffffff}) [ 3392.176269][T16599] binder: 16560:16599 got transaction to invalid handle [ 3392.183245][T16599] binder: 16560:16599 transaction failed 29201/-22, size 0-12288 line 2994 [ 3392.193785][T16564] binder: 16563:16564 ioctl 40046207 0 returned -16 06:14:34 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x700000000000000}, 0x0) 06:14:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf000}, 0x0) [ 3392.265308][T16599] binder: 16560:16599 got transaction to invalid handle 06:14:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x74000000, &(0x7f0000000300)}) 06:14:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x500000000000000, &(0x7f0000000300)}) 06:14:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4c000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4c000000, 0xffffffffffffffff}) [ 3392.430298][T16960] binder: 16919:16960 got transaction with invalid offsets ptr 06:14:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) 06:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xfede}, 0x0) [ 3392.478849][T16960] binder: 16919:16960 ioctl c0306201 20000040 returned -14 [ 3392.499511][T16984] binder: 16983:16984 got transaction to invalid handle [ 3392.519802][T16986] binder: BINDER_SET_CONTEXT_MGR already set 06:14:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x68000000, 0xffffffffffffffff}) [ 3392.537344][T16986] binder: 16985:16986 ioctl 40046207 0 returned -16 06:14:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a000000, &(0x7f0000000300)}) 06:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x34000}, 0x0) 06:14:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x600000000000000, &(0x7f0000000300)}) 06:14:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6c000000, 0xffffffffffffffff}) [ 3392.708522][T17350] binder: 17346:17350 got transaction with invalid offsets ptr 06:14:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xe00000000000000}, 0x0) 06:14:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x60000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3392.787408][T17401] binder: BINDER_SET_CONTEXT_MGR already set [ 3392.792188][T17350] binder: 17346:17350 ioctl c0306201 20000040 returned -14 [ 3392.821471][T17401] binder: 17398:17401 ioctl 40046207 0 returned -16 06:14:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x74000000, 0xffffffffffffffff}) 06:14:35 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x3d59000000000000}, 0x0) 06:14:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x700000000000000, &(0x7f0000000300)}) 06:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x400300}, 0x0) [ 3392.955379][T17543] binder: 17526:17543 got transaction to invalid handle 06:14:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xfdfdffff, &(0x7f0000000300)}) 06:14:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7a000000, 0xffffffffffffffff}) [ 3393.096260][T17737] binder_alloc: 17735: binder_alloc_buf failed to map page at 20002000 in userspace [ 3393.116198][T17741] binder: BINDER_SET_CONTEXT_MGR already set [ 3393.124688][T17741] binder: 17739:17741 ioctl 40046207 0 returned -16 06:14:35 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf0ffff}, 0x0) [ 3393.140221][T17737] binder: 17735:17737 ioctl c0306201 20000040 returned -14 [ 3393.156797][T17741] binder_alloc: 17735: binder_alloc_buf failed to map page at 20002000 in userspace [ 3393.172369][T17741] binder: 17739:17741 ioctl c0306201 20000040 returned -14 06:14:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xbf000000, 0xffffffffffffffff}) 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfd000000, 0xffffffffffffffff}) 06:14:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x6000000000000000}, 0x0) 06:14:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x1200000000000000, &(0x7f0000000300)}) 06:14:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x68000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xfffffdfd, &(0x7f0000000300)}) [ 3393.409240][T18251] binder_alloc: 18248: binder_alloc_buf failed to map page at 20002000 in userspace [ 3393.433954][T18251] binder: 18248:18251 ioctl c0306201 20000040 returned -14 06:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x1000000}, 0x0) 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfdfdffff, 0xffffffffffffffff}) [ 3393.483414][T18268] binder: BINDER_SET_CONTEXT_MGR already set [ 3393.511674][T18268] binder: 18259:18268 ioctl 40046207 0 returned -16 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfffffdfd, 0xffffffffffffffff}) 06:14:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2000000000000000, &(0x7f0000000300)}) 06:14:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0x9effffff00000000}, 0x0) [ 3393.686505][T18634] binder_alloc: 18625: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x30000000000000, &(0x7f0000000300)}) 06:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x2000000}, 0x0) 06:14:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6c000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x100000000000000, 0xffffffffffffffff}) [ 3393.747751][T18634] binder: 18625:18634 ioctl c0306201 20000040 returned -14 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x200000000000000, 0xffffffffffffffff}) [ 3393.830797][T18695] binder: BINDER_SET_CONTEXT_MGR already set [ 3393.855969][T18695] binder: 18683:18695 ioctl 40046207 0 returned -16 06:14:36 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xc00e000000000000}, 0x0) 06:14:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x3f00000000000000, &(0x7f0000000300)}) 06:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x3000000}, 0x0) 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x300000000000000, 0xffffffffffffffff}) [ 3394.053503][T19035] binder_alloc: 19032: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x100000000000000, &(0x7f0000000300)}) [ 3394.096573][T19035] binder: 19032:19035 ioctl c0306201 20000040 returned -14 06:14:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x74000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:36 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x4000000}, 0x0) 06:14:36 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x400000000000000, 0xffffffffffffffff}) [ 3394.179886][T19238] binder: BINDER_SET_CONTEXT_MGR already set [ 3394.232237][T19238] binder: 19237:19238 ioctl 40046207 0 returned -16 06:14:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4800000000000000, &(0x7f0000000300)}) 06:14:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x500000000000000, 0xffffffffffffffff}) 06:14:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x200000000000000, &(0x7f0000000300)}) 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x600000000000000, 0xffffffffffffffff}) [ 3394.437535][T19464] binder_alloc: 19462: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x6000000}, 0x0) [ 3394.482607][T19464] binder: 19462:19464 ioctl c0306201 20000040 returned -14 [ 3394.506924][T19590] binder: BINDER_SET_CONTEXT_MGR already set [ 3394.522149][T19590] binder: 19589:19590 ioctl 40046207 0 returned -16 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x700000000000000, 0xffffffffffffffff}) 06:14:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) 06:14:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7a000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xa000000}, 0x0) 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x800000000000000, 0xffffffffffffffff}) 06:14:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x300000000000000, &(0x7f0000000300)}) 06:14:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c00000000000000, &(0x7f0000000300)}) 06:14:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0) [ 3394.819046][T20108] binder_alloc: 20103: binder_alloc_buf failed to map page at 20002000 in userspace [ 3394.854537][T20123] binder: BINDER_SET_CONTEXT_MGR already set 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xa00000000000000, 0xffffffffffffffff}) 06:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xc000000}, 0x0) [ 3394.875357][T20123] binder: 20100:20123 ioctl 40046207 0 returned -16 [ 3394.887385][T20108] binder: 20103:20108 ioctl c0306201 20000040 returned -14 06:14:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0xfdfdffff, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x2100000000000000, 0xffffffffffffffff}) 06:14:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6000000000000000, &(0x7f0000000300)}) 06:14:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x2) 06:14:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x400000000000000, &(0x7f0000000300)}) [ 3395.097242][T20449] binder_transaction: 3 callbacks suppressed [ 3395.097252][T20449] binder: 20444:20449 got transaction to invalid handle [ 3395.130970][T20459] binder_alloc: 20458: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4200000000000000, 0xffffffffffffffff}) [ 3395.186005][T20459] binder: 20458:20459 ioctl c0306201 20000040 returned -14 [ 3395.217672][T20492] binder: BINDER_SET_CONTEXT_MGR already set 06:14:37 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xe000000}, 0x0) 06:14:37 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x3) [ 3395.241315][T20492] binder: 20475:20492 ioctl 40046207 0 returned -16 06:14:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4800000000000000, 0xffffffffffffffff}) 06:14:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6800000000000000, &(0x7f0000000300)}) 06:14:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x4) 06:14:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x500000000000000, &(0x7f0000000300)}) [ 3395.438486][T20873] binder_alloc: 20865: binder_alloc_buf failed to map page at 20002000 in userspace [ 3395.486014][T20873] binder: 20865:20873 ioctl c0306201 20000040 returned -14 06:14:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0xfffffdfd, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf000000}, 0x0) 06:14:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x4c00000000000000, 0xffffffffffffffff}) 06:14:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x7) [ 3395.555393][T20941] binder: BINDER_SET_CONTEXT_MGR already set 06:14:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6800000000000000, 0xffffffffffffffff}) [ 3395.613869][T20941] binder: 20927:20941 ioctl 40046207 0 returned -16 06:14:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c00000000000000, &(0x7f0000000300)}) [ 3395.685620][T21019] binder: 20991:21019 got transaction to invalid handle 06:14:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xa) 06:14:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x6c00000000000000, 0xffffffffffffffff}) 06:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x10000000}, 0x0) [ 3395.726476][T21187] binder_alloc: 21182: binder_alloc_buf failed to map page at 20002000 in userspace [ 3395.746410][T21187] binder: 21182:21187 ioctl c0306201 20000040 returned -14 06:14:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x600000000000000, &(0x7f0000000300)}) 06:14:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7400000000000000, &(0x7f0000000300)}) [ 3395.880448][T21409] binder: BINDER_SET_CONTEXT_MGR already set [ 3395.919099][T21409] binder: 21403:21409 ioctl 40046207 0 returned -16 06:14:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7400000000000000, 0xffffffffffffffff}) [ 3395.995438][T21582] binder_alloc: 21574: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x30000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x60000000}, 0x0) 06:14:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xe) 06:14:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x700000000000000, &(0x7f0000000300)}) [ 3396.051903][T21582] binder_transaction: 20 callbacks suppressed [ 3396.051922][T21582] binder: 21574:21582 transaction failed 29201/-12, size 0-12288 line 3147 [ 3396.115641][T21582] binder: 21574:21582 ioctl c0306201 20000040 returned -14 [ 3396.154004][T21696] binder_alloc: 21574: binder_alloc_buf failed to map page at 20002000 in userspace [ 3396.174738][T21694] binder: BINDER_SET_CONTEXT_MGR already set [ 3396.181005][T21696] binder: 21672:21696 transaction failed 29201/-12, size 0-12288 line 3147 [ 3396.190094][T21694] binder: 21677:21694 ioctl 40046207 0 returned -16 [ 3396.199605][T21694] binder_alloc: 21574: binder_alloc_buf failed to map page at 20002000 in userspace [ 3396.210085][T21694] binder: 21677:21694 transaction failed 29201/-12, size 0-12288 line 3147 06:14:38 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x7a00000000000000, 0xffffffffffffffff}) 06:14:38 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x60) [ 3396.220690][T21694] binder: 21677:21694 ioctl c0306201 20000040 returned -14 06:14:38 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x65580000}, 0x0) 06:14:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a00000000000000, &(0x7f0000000300)}) 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xbf00000000000000, 0xffffffffffffffff}) 06:14:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xa00000000000000, &(0x7f0000000300)}) [ 3396.410970][T22094] binder_alloc: 22092: binder_alloc_buf failed to map page at 20002000 in userspace [ 3396.446385][T22115] binder: BINDER_SET_CONTEXT_MGR already set 06:14:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x100000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfd00000000000000, 0xffffffffffffffff}) [ 3396.454532][T22094] binder: 22092:22094 transaction failed 29201/-12, size 0-12288 line 3147 [ 3396.461791][T22115] binder: 22106:22115 ioctl 40046207 0 returned -16 06:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x81000000}, 0x0) [ 3396.516074][T22094] binder: 22092:22094 ioctl c0306201 20000040 returned -14 [ 3396.538031][T22225] binder_alloc: 22092: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xf0) 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0xfdfdffff00000000, 0xffffffffffffffff}) [ 3396.560242][T22225] binder: 22213:22225 transaction failed 29201/-12, size 0-12288 line 3147 06:14:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x8000000000000000, &(0x7f0000000300)}) 06:14:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x1200000000000000, &(0x7f0000000300)}) 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x2}) 06:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x88a8ffff}, 0x0) [ 3396.773954][T22605] binder: 22604:22605 got transaction with invalid offsets ptr 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x3}) 06:14:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x200000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3396.822390][T22605] binder: 22604:22605 transaction failed 29201/-14, size 0-12288 line 3193 [ 3396.827611][T22640] binder: BINDER_SET_CONTEXT_MGR already set [ 3396.841489][T22605] binder: 22604:22605 ioctl c0306201 20000040 returned -14 [ 3396.855435][T22640] binder: 22639:22640 ioctl 40046207 0 returned -16 06:14:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x300) [ 3396.925104][T22790] binder: 22776:22790 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4}) 06:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x9effffff}, 0x0) 06:14:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xfdfdffff00000000, &(0x7f0000000300)}) [ 3396.985805][T22790] binder: 22776:22790 transaction failed 29201/-22, size 0-12288 line 3241 06:14:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x2000000000000000, &(0x7f0000000300)}) [ 3397.110050][T23005] binder_alloc: 22986: binder_alloc_buf failed to map page at 20002000 in userspace [ 3397.131175][T23028] binder: BINDER_SET_CONTEXT_MGR already set [ 3397.137474][T23005] binder: 22986:23005 transaction failed 29201/-12, size 0-12288 line 3147 [ 3397.151414][T23028] binder: 23019:23028 ioctl 40046207 0 returned -16 06:14:39 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x700) 06:14:39 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x5}) [ 3397.164334][T23028] binder_alloc: 22986: binder_alloc_buf failed to map page at 20002000 in userspace [ 3397.175204][T23005] binder: 22986:23005 ioctl c0306201 20000040 returned -14 [ 3397.185949][T23028] binder: 23019:23028 transaction failed 29201/-12, size 0-12288 line 3147 [ 3397.195311][T23028] binder: 23019:23028 ioctl c0306201 20000040 returned -14 06:14:39 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xaf580000}, 0x0) 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6}) 06:14:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xffffffff00000000, &(0x7f0000000300)}) 06:14:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xa00) [ 3397.442805][T23451] binder_alloc: 23425: binder_alloc_buf failed to map page at 20002000 in userspace [ 3397.473730][T23451] binder: 23425:23451 transaction failed 29201/-12, size 0-12288 line 3147 06:14:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x300000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4800000000000000, &(0x7f0000000300)}) 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7}) [ 3397.494042][T23451] binder: 23425:23451 ioctl c0306201 20000040 returned -14 06:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xdefe0000}, 0x0) 06:14:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xe00) 06:14:40 executing program 4: r0 = msgget(0x0, 0x2) msgctl$MSG_STAT(r0, 0xb, &(0x7f00000002c0)=""/206) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x4000, 0x0) clock_settime(0x7, &(0x7f0000000140)={0x0, 0x1c9c380}) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000200)={0x9, {{0x2, 0x4e20, @broadcast}}}, 0x84) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x8}) [ 3397.571237][T23553] binder: BINDER_SET_CONTEXT_MGR already set [ 3397.602493][T23553] binder: 23546:23553 ioctl 40046207 0 returned -16 [ 3397.609421][T23582] binder_alloc: 23425: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xa}) 06:14:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x4c00000000000000, &(0x7f0000000300)}) [ 3397.722662][T23779] binder: BINDER_SET_CONTEXT_MGR already set [ 3397.751927][T23779] binder: 23714:23779 ioctl 40046207 0 returned -16 06:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf0ffffff}, 0x0) 06:14:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xec0) [ 3397.866949][T23964] binder: 23910:23964 got transaction with invalid offsets ptr [ 3397.874717][T23964] binder: 23910:23964 ioctl c0306201 20000040 returned -14 06:14:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x400000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x21}) [ 3398.054126][T24180] binder: BINDER_SET_CONTEXT_MGR already set 06:14:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xffffa888}, 0x0) 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x42}) [ 3398.106425][T24180] binder: 24107:24180 ioctl 40046207 0 returned -16 [ 3398.106491][T24258] binder: 24190:24258 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6000000000000000, &(0x7f0000000300)}) 06:14:40 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x3d59) 06:14:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x500000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x48}) 06:14:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = shmget$private(0x0, 0x1000, 0x78000a00, &(0x7f0000003000/0x1000)=nil) shmat(r2, &(0x7f0000003000/0x1000)=nil, 0x2000) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x20800) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r3, 0x110, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) write$cgroup_int(r3, &(0x7f0000000140)=0x8001, 0x12) [ 3398.259299][T24458] binder: 24450:24458 got transaction with invalid offsets ptr [ 3398.287947][T24458] binder: 24450:24458 ioctl c0306201 20000040 returned -14 06:14:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x593d) [ 3398.357229][T24608] binder: BINDER_SET_CONTEXT_MGR already set 06:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xfffff000}, 0x0) 06:14:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4c}) [ 3398.406335][T24608] binder: 24591:24608 ioctl 40046207 0 returned -16 [ 3398.413202][T24639] binder: 24629:24639 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x6000) 06:14:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6800000000000000, &(0x7f0000000300)}) 06:14:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0xb5, 0x0, &(0x7f00000002c0)="bfbed573c8662eef67fbbde5e3b03953e36e86261ec854093af7747f2261700318570c13ca30e0c5d3df16aa7e155445d4077599c0d0c00f5e6349e1fd772e6e8cfbce85ef75495eeff8da99deaea100f708fbbf92166fc4424391f978cebfdf3541b7ccf7105d2599d64568d385cb62112084cc83f756271c6ff1aac0dc5651312bd644b2b4aa27e1c5a0875dcb3d97a0e2c807f9cf157f9b0e1d46b6d032cbf9943e5a9b3a000000000000000000000000000000"}) 06:14:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x68}) [ 3398.626667][T24930] binder: 24929:24930 got transaction with invalid offsets ptr [ 3398.643452][T24932] binder: BINDER_SET_CONTEXT_MGR already set [ 3398.666155][T24930] binder: 24929:24930 ioctl c0306201 20000040 returned -14 06:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xffffff7f}, 0x0) 06:14:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xc00e) [ 3398.673187][T24932] binder: 24931:24932 ioctl 40046207 0 returned -16 06:14:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x600000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6c}) 06:14:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x6c00000000000000, &(0x7f0000000300)}) 06:14:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xf000) 06:14:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x74}) 06:14:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3398.930880][T25309] binder: 25304:25309 got transaction with invalid offsets ptr 06:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xffffff9e}, 0x0) [ 3398.996853][T25309] binder: 25304:25309 ioctl c0306201 20000040 returned -14 06:14:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7a}) [ 3399.047682][T25369] binder: BINDER_SET_CONTEXT_MGR already set [ 3399.066992][T25369] binder: 25367:25369 ioctl 40046207 0 returned -16 [ 3399.095386][T25369] binder: 25367:25369 got transaction with invalid offsets ptr 06:14:41 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xfffffff0}, 0x0) 06:14:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xbf}) 06:14:41 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x34000) 06:14:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7400000000000000, &(0x7f0000000300)}) 06:14:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x700000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:42 executing program 4: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x29, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="05630440020000009b4a0a836f87dae7c2b537a3d059f691db5b51671ad5254f95705e4f199b8571a091d79a1a9acc25bf90da074ca35966c5bc95eca855dbb7471a67705b4513a65c93f583aeaefe672ef4b032b4fe"], 0xffb4, 0x0, &(0x7f0000000300)}) 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfd}) [ 3399.315863][T25816] binder: 25815:25816 got transaction with invalid offsets ptr [ 3399.329837][T25836] binder_alloc: 25815: binder_alloc_buf size 12288 failed, no address space 06:14:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x400300) 06:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x40030000000000}, 0x0) 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x300}) [ 3399.402259][T25836] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) [ 3399.420507][T25868] binder: BINDER_SET_CONTEXT_MGR already set [ 3399.429238][T25816] binder: 25815:25816 ioctl c0306201 20000040 returned -14 [ 3399.471104][T25868] binder: 25867:25868 ioctl 40046207 0 returned -16 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x500}) 06:14:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x7a00000000000000, &(0x7f0000000300)}) 06:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0) 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x600}) [ 3399.654200][T26232] binder: 26208:26232 got transaction with invalid offsets ptr 06:14:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xf0ffff) 06:14:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="0800054000000000382d6867bae44f01c45f69f16ba1ed6802e1a68a52f813"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3399.711346][T26232] binder: 26208:26232 ioctl c0306201 20000040 returned -14 06:14:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x1200000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x700}) 06:14:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x1000000) [ 3399.825649][T26412] binder: BINDER_SET_CONTEXT_MGR already set 06:14:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0xfdfdffff00000000, &(0x7f0000000300)}) 06:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x100000000000000}, 0x0) [ 3399.890525][T26412] binder: 26375:26412 ioctl 40046207 0 returned -16 [ 3399.890602][T26486] binder: 26471:26486 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xa00}) [ 3399.954015][T26542] binder: 26536:26542 got transaction with invalid offsets ptr [ 3400.002775][T26542] binder: 26536:26542 ioctl c0306201 20000040 returned -14 06:14:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4000, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x2100}) 06:14:42 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x2000000) 06:14:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x2000000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3400.114564][T26774] binder: BINDER_SET_CONTEXT_MGR already set [ 3400.121023][T26774] binder: 26759:26774 ioctl 40046207 0 returned -16 [ 3400.137421][T26774] binder: 26759:26774 got transaction with invalid offsets ptr 06:14:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4200}) 06:14:42 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x200000000000000}, 0x0) 06:14:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x21aa01, 0x0) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000140)={0x82c9, 0x5, 0x3}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket(0x6, 0x7, 0xffffffffffff8001) bind$isdn_base(r2, &(0x7f0000000000)={0x22, 0x30, 0x20, 0xcb9d, 0x401}, 0x6) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4800}) [ 3400.382405][T27069] binder: 27055:27069 got transaction with invalid offsets ptr [ 3400.414564][T27116] binder: BINDER_SET_CONTEXT_MGR already set 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4c00}) 06:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x300000000000000}, 0x0) [ 3400.441183][T27116] binder: 27109:27116 ioctl 40046207 0 returned -16 06:14:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000200)={0x0, 0xe40, 0x100000000, 0x0, 0x40, 0x1000, 0x6, 0x0, {0x0, @in6={{0xa, 0x4e24, 0x8, @mcast1, 0x3}}, 0x10000, 0x4, 0x2, 0x8614, 0x8}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000180)={r3, 0x800, 0x1, [0x181f]}, &(0x7f00000002c0)=0xa) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000f2954a30"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6800}) 06:14:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x3f00000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:43 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x3000000) 06:14:43 executing program 4: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1, 0x200000) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000300)}) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1) 06:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x400000000000000}, 0x0) 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6c00}) 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7400}) 06:14:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x8, 0x0) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f00000003c0)) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mixer\x00', 0x400000, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f00000002c0)={0x0, 0x1}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000340)={0x5, 0x8, 0x0, 0x4, 0x31, 0xb7, 0x200, 0x57ed, r3}, 0x20) r4 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000ff0100000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0000000000000000db36132d20530a05cfc32e103c26382dc634cebbb1e7a7225b1492625d81978faba0061e40314dbe30d760ce00d79d970aa513035ea83551a799"]], 0x1fd, 0x0, &(0x7f0000000300)}) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x100, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r5, 0x4040534e, &(0x7f0000000140)={0x0, @tick=0x1ff, 0x2, {0x4, 0x8000}, 0x1687, 0x0, 0x4}) io_setup(0x3, &(0x7f0000000180)=0x0) io_getevents(r6, 0x8, 0x1, &(0x7f00000001c0)=[{}], 0x0) r7 = getpid() fcntl$lock(r0, 0x25, &(0x7f0000000380)={0x0, 0x3, 0x4, 0xdb15aae, r7}) 06:14:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={r2, @in={{0x2, 0x4e21, @rand_addr=0x7}}, 0x2, 0x3, 0x4, 0x1, 0x62}, 0x98) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4018641b, &(0x7f0000000180)={&(0x7f0000001000/0x4000)=nil, 0x5, 0x7, 0x4, &(0x7f0000001000/0x3000)=nil, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4000000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7a00}) 06:14:43 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x4000000) 06:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x600000000000000}, 0x0) [ 3401.002922][T27964] binder: 27962:27964 ioctl 4018641b 20000180 returned -22 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xbf00}) [ 3401.071070][T27988] binder_alloc: 27962: binder_alloc_buf failed to map page at 20002000 in userspace [ 3401.104169][T27988] binder_transaction: 19 callbacks suppressed [ 3401.104380][T27988] binder: 27978:27988 transaction failed 29201/-12, size 0-12288 line 3147 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfd00}) 06:14:43 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x7000000) 06:14:43 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xa00000000000000}, 0x0) 06:14:43 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x1000000}) 06:14:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket(0x2, 0x1, 0x101) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0xfffffffffffffeb7, 0x0, &(0x7f0000000300)}) 06:14:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x284000, 0x0) symlinkat(&(0x7f0000000000)='./file0\x00', r2, &(0x7f0000000180)='./file0\x00') ioctl$SNDRV_TIMER_IOCTL_TREAD(r2, 0x40045402, &(0x7f0000000200)=0x1) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) fcntl$setsig(r1, 0xa, 0x28) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4800000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x2000000}) [ 3401.413762][T28421] binder_alloc: 28417: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xa000000) 06:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xc00000000000000}, 0x0) 06:14:44 executing program 2: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc2c45512, &(0x7f0000000200)={{0x9, 0x7, 0x6, 0x9, '\x00', 0x8}, 0x1, [0x4, 0x1000, 0x3, 0x7ff, 0x4, 0x1, 0x100000000, 0xba, 0x101, 0xfffffffffffffff7, 0x5, 0x6, 0x3, 0x3553, 0x3, 0x8, 0x1f, 0x3fc00000, 0x52, 0xc4, 0x20, 0x5, 0x994b, 0xd6, 0x100000000, 0x9, 0x7, 0x8, 0xffffffffffffffc0, 0x3, 0x1, 0x7cb, 0x7, 0x10, 0x5, 0x4, 0x6, 0x5, 0x6, 0x0, 0x0, 0x5e4, 0xfdc, 0x80, 0x5, 0x0, 0x6, 0xb9a7, 0xfffffffffffffffe, 0x1ff, 0xf7a5, 0x6eb, 0x5, 0x200, 0x8001, 0x3, 0x5, 0x7, 0x2507, 0x10001, 0x0, 0x7862, 0x1000, 0x9, 0x6, 0xfff, 0x2, 0x3ff, 0x200, 0x101, 0x4, 0x2, 0x1, 0x1, 0x6, 0x8001, 0x8000, 0x8, 0x7, 0x6, 0x1, 0x7, 0x400, 0x10001, 0x800, 0x100, 0xfffffffffffffffa, 0x81, 0x7, 0x3, 0x5, 0x1f, 0x101, 0xbb9, 0x0, 0x7, 0x0, 0x101, 0x6a07, 0x1, 0x2, 0x3ff, 0x1, 0x1, 0x0, 0x3, 0x5, 0x4, 0x0, 0x3ff, 0x3, 0x6, 0x3, 0x10000, 0x4, 0xae3, 0x3f, 0xe440, 0x5, 0x2, 0x5, 0x80, 0x100000000, 0x40, 0x6, 0x1f, 0x101, 0x3], {0x0, 0x989680}}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3401.471104][T28421] binder: 28417:28421 transaction failed 29201/-12, size 0-12288 line 3147 [ 3401.493575][T28582] binder_alloc: 28417: binder_alloc_buf failed to map page at 20002000 in userspace [ 3401.551200][T28582] binder: 28530:28582 transaction failed 29201/-12, size 0-12288 line 3147 06:14:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x3000000}) [ 3401.628095][T28703] binder: BINDER_SET_CONTEXT_MGR already set [ 3401.637048][T28703] binder: 28651:28703 ioctl 40046207 0 returned -16 [ 3401.651728][T28703] binder_alloc: 28417: binder_alloc_buf failed to map pages in userspace, no vma 06:14:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0185649, &(0x7f0000000200)={0xbf0000, 0x1, 0x2, [], &(0x7f0000000180)={0x990a61, 0x20, [], @value=0x9}}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r3 = socket$netlink(0x10, 0x3, 0x12) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000000)=0x3, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x10a, 0x0, &(0x7f0000000300)}) 06:14:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xe000000) 06:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xe00000000000000}, 0x0) [ 3401.669502][T28703] binder: 28651:28703 transaction failed 29189/-3, size 0-12288 line 3147 06:14:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4000000}) 06:14:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x4c00000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3, 0x240201) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000140)={0x5, &(0x7f0000000200)=[{}, {}, {}, {}, {}]}) vmsplice(r2, &(0x7f0000000700)=[{&(0x7f0000000500)="01ee52602a6814df6bfe0f0751d2f47d75dc9083c7e45f75262992670da43072b97a515ccc8a2975b5dfba4c88d7ab9dfcdba2c66388d7bf13b17f13907f24525de543eef46e05f14c536ca879d36fe22e0d8e9bb28da0a730818c27b7a6bcb1db1a8fdb212f666a2d41a73f816188c93c9286f8e9e3e9d5041914ade21b67c3bff82e5494b61ab8d2d067f6cc38ec41a6014116d09dcc838d0173a3ccc502c120eb09c5cc428eebddc5d005980f77a92f5cea67de2804be465e7aa942498b699f90c05178f4f1b040bc0b4c6c8cae3cd336dd6af420cbae39759c0c8f42c27a946742a4747dd3b14d3d1117ed95b755666a932d33b9", 0xf6}, {&(0x7f0000000600)="8fa6aac345f90bbeb6a0a07de663a4bac2c361bdc92d80ecd4072b2d80ba852cbfc2012fae299d72785ec1de0d98d6e37c82afa837494e9b69095d56155d364fbd4add842ce5a62c8f0c76e8f9a139296e77574a16a9d61571cc7a09", 0x5c}, {&(0x7f0000000180)="158458ae93ad7411f7c1d6841f091a35d028a398f5341623e317b6623f", 0x1d}, {&(0x7f0000000680)="b1dd4c5112464a864850ed220b62ad6e93c206f55cbe94073bef045b4866fb244ba722d00f4ea555961b00648bf6cc88465650c3c8cc563e3b34d0a53974556dacbf1849213d3d84558efad8fc4279ba5a9af2051ac340a710221ca6", 0x5c}], 0x4, 0x2) open(&(0x7f0000000740)='./file0\x00', 0x20400, 0x1) 06:14:44 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x3d590000) [ 3401.981577][T29013] binder: 29012:29013 got transaction with invalid offset (0, min 0 max 0) or object. [ 3402.008763][T29013] binder: 29012:29013 transaction failed 29201/-22, size 0-8 line 3241 06:14:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x5000000}) 06:14:44 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf00000000000000}, 0x0) [ 3402.087053][T29131] binder: BINDER_SET_CONTEXT_MGR already set [ 3402.102496][T29131] binder: 29051:29131 ioctl 40046207 0 returned -16 [ 3402.109444][T29139] binder_alloc: 29012: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x200000, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6000000}) [ 3402.209349][T29232] binder: BINDER_SET_CONTEXT_MGR already set [ 3402.236482][T29232] binder: 29230:29232 ioctl 40046207 0 returned -16 [ 3402.249129][T29139] binder: 29050:29139 transaction failed 29201/-12, size 0-12288 line 3147 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7000000}) 06:14:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$setlease(r0, 0x400, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xfd9a, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000030000002442e54200000000000000000000000000000000000000000030000000000000ee87459d687e7e405e638fb03d26a6d09d357383ed6974a13b6b29d428bde34762eb1751aae222c11f12d696748110f1ed7eddf8c94d584878b8509ca36224b7b3f12b9efd09d37d076a847e3158cb0ff1d4a0de82ae53fe9aabaa", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000001000000"]], 0x33a}) 06:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x1000000000000000}, 0x0) 06:14:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x60000000) 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x8000000}) [ 3402.495875][T29681] binder: 29656:29681 got transaction to context manager from process owning it 06:14:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6000000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x6000000000000000}, 0x0) [ 3402.540948][T29681] binder: 29656:29681 transaction failed 29201/-22, size 12288-4647290853273208814 line 2985 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xa000000}) [ 3402.589239][T29753] binder: BINDER_SET_CONTEXT_MGR already set [ 3402.615851][T29753] binder: 29750:29753 ioctl 40046207 0 returned -16 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x21000000}) [ 3402.637314][T29753] binder_alloc: 29656: binder_alloc_buf, no vma [ 3402.661866][T29753] binder: 29750:29753 transaction failed 29189/-3, size 0-12288 line 3147 [ 3402.675619][T29790] binder_alloc: 29656: binder_alloc_buf, no vma 06:14:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000140)=0x6af24187, 0x4) socket$tipc(0x1e, 0x2, 0x0) ioctl$FS_IOC_SETVERSION(r1, 0x40047602, &(0x7f00000003c0)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000180)=0xe8) r4 = request_key(&(0x7f0000000300)='ceph\x00', &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000380)='\x00', 0xffffffffffffffff) keyctl$get_persistent(0x16, r3, r4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x42000000}) [ 3402.716219][T29790] binder: 29768:29790 transaction failed 29189/-3, size 0-12288 line 3147 06:14:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x9effffff) 06:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x6558000000000000}, 0x0) 06:14:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xc00e0000) [ 3402.801847][T30024] binder: 30023:30024 ioctl 40047602 200003c0 returned -22 [ 3402.841783][T30024] binder: 30023:30024 transaction failed 29201/-14, size 0-12288 line 3193 06:14:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x200840) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000200)={{{@in=@multicast1, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000300)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) r5 = getuid() r6 = getuid() getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)=0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0}, &(0x7f0000000540)=0xc) fstat(r1, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) r10 = getgid() fstat(r2, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000700)={0x0, 0x0, 0x0}, &(0x7f0000000740)=0xc) stat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r15 = getegid() lstat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r17 = getgid() getresgid(&(0x7f0000000900), &(0x7f0000000940)=0x0, &(0x7f0000000980)) fsetxattr$system_posix_acl(r1, &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f00000009c0)={{}, {0x1, 0x6}, [{0x2, 0x6, r3}, {0x2, 0x0, r4}, {0x2, 0x4, r5}, {0x2, 0x6, r6}, {0x2, 0x1, r7}, {0x2, 0x4, r8}, {0x2, 0x3, r9}], {}, [{0x8, 0x2, r10}, {0x8, 0x4, r11}, {0x8, 0x5, r12}, {0x8, 0x1, r13}, {0x8, 0x6, r14}, {0x8, 0x6, r15}, {0x8, 0x4, r16}, {0x8, 0x2, r17}, {0x8, 0x3, r18}], {0x10, 0x4}, {0x20, 0x7}}, 0xa4, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x48000000}) 06:14:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6800000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:45 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000480)='/proc/self/net/pfkey\x00', 0x400000, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x24, 0x0, &(0x7f0000000180)=[@decrefs={0x40046307, 0x3}, @decrefs, @acquire_done={0x40106309, r1, 0x2}], 0xe0, 0x0, &(0x7f0000000200)="a2a9c343827d10f97fcb9300779da32eeede25bb58aa259d614d4824ab015462bde01238e786744239a693ca994aa0c45e8548ae010e6410d76f61004b4b1c4b2f976920ad1d572663b9f8e71a8d6b6dccd166e3491790299539a9d6bc0b606e25ac6c723b80a862480f2e4ff1c1fc9060faa511e0f5314fcb05ff92466a54aa40da63a593b589c2efa499be165810353e79af0165fe5c95e0c464da9e23e176a8ad75c410f2d873278150a17df692cc684d3b06fc3bc79d82eb44baa906ebfd3c7d7f3a09eaca065e2473ad1b616ffb9718b9e697b05a5a566bd0336a4fa274"}) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) mount(&(0x7f0000000340)=@nullb='/dev/nullb0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='ext2\x00', 0x2000000, &(0x7f0000000400)='/proc/self/net/pfkey\x00') ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:45 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x8100000000000000}, 0x0) 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4c000000}) 06:14:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xf0ffffff) 06:14:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3403.184078][T30486] binder_transaction: 2 callbacks suppressed [ 3403.184090][T30486] binder: 30485:30486 got transaction with invalid offsets ptr [ 3403.218915][T30536] binder_alloc: 30485: binder_alloc_buf size 12288 failed, no address space 06:14:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x68000000}) 06:14:45 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xfffff000) [ 3403.232348][T30536] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) [ 3403.253989][T30579] binder_alloc: 30560: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x88a8ffff00000000}, 0x0) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6c000000}) 06:14:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x5, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x220800, 0x0) recvmsg(r2, &(0x7f0000000840)={&(0x7f0000000140)=@rc, 0x80, &(0x7f0000000700)=[{&(0x7f0000000200)=""/174, 0xae}, {&(0x7f00000002c0)=""/233, 0xe9}, {&(0x7f00000003c0)=""/244, 0xf4}, {&(0x7f00000004c0)=""/104, 0x68}, {&(0x7f0000000540)=""/124, 0x7c}, {&(0x7f00000005c0)=""/3, 0x3}, {&(0x7f0000000600)=""/240, 0xf0}], 0x7, &(0x7f0000000740)=""/245, 0xf5}, 0x40000000) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000880)='/proc/self/attr/exec\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x74000000}) 06:14:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x6c00000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) sysfs$1(0x1, &(0x7f0000000000)='/dev/binder#\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xffffff7f) [ 3403.514389][T30951] binder: BINDER_SET_CONTEXT_MGR already set [ 3403.554402][T30951] binder: 30948:30951 ioctl 40046207 0 returned -16 06:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x9effffff00000000}, 0x0) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7a000000}) 06:14:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xffffff9e) [ 3403.637191][T31022] binder: 31021:31022 got transaction with invalid offsets ptr [ 3403.642962][T31032] binder_alloc: 31021: binder_alloc_buf size 12288 failed, no address space [ 3403.693065][T31032] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xbf000000}) 06:14:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40000, 0x0) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f0000000200)=""/142) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = dup3(r1, r1, 0x80000) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f0000000140)={0x10000, 0xf, "ca5a374f2ca11117994233c2095f73f4973ef1f3039ba9b9dc15ae712c01adb4", 0x7, 0x7fff000000000, 0x9, 0x4, 0x40}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfd000000}) 06:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xaf58000000000000}, 0x0) [ 3403.918253][T31436] binder: 31433:31436 got transaction with invalid offsets ptr [ 3403.951165][T31435] binder: BINDER_SET_CONTEXT_MGR already set 06:14:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xfffffff0) 06:14:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7400000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfdfdffff}) [ 3403.966399][T31435] binder: 31434:31435 ioctl 40046207 0 returned -16 [ 3403.981056][T31435] binder_alloc: 31433: binder_alloc_buf size 12288 failed, no address space [ 3404.023895][T31435] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) [ 3404.053221][T31529] binder: 31528:31529 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:46 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x10000000000) 06:14:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfffffdfd}) 06:14:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xdefe000000000000}, 0x0) 06:14:46 executing program 4: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3ff, 0x0) ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000140)={0x10001, 0xffff, 0x7f}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:46 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$caif_stream(0x25, 0x1, 0x3) getsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000100), &(0x7f0000000180)=0x8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) dup2(r0, r0) splice(0xffffffffffffffff, &(0x7f0000000000), r0, &(0x7f0000000140), 0x2, 0x6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0xfffffffffffffd7c, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0xfffffffffffffffd, 0x0, &(0x7f0000000200)="de7909d001a0c184bf6c8553a1bc90ea6a45d5d4d19805f7a37a88dac37ac10b1e5ba513278c9aa1ff2675d8dccacbea20b1eac651437857a176ce0116d60a378440e101b15999aaa0be1b986f15dd306f2718061d17b64bf8782be941463dea6f60dc05c154bc8060d85296e7b609824784083595723971fc96dc1a48598b1d3c610d2846"}) 06:14:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x100000000000000}) 06:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 06:14:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x7a00000000000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x10000, 0x200) write$ppp(r2, &(0x7f0000000200)="13a99e0aa0e4ed44300d248aed2a862c665a2ac1bd4438d1dc33d413029be3a1f591b35b0c26371ef67dca0b2f39b5b7f077dc6d5954725f6b10c068f8636e346267ab4697b698f15ff2f06c406e8764e63eecd93bc578c7dbe15281e3789b166bf56bc59ad02ae6574552da0fde94eb29a83b36408a8a94114a2c56e2bf80b24a6d", 0x82) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000140)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB="0000190000b50300004347d544c0eeb1d5fe529da7b970859caab84496e71e3e55a25ae0e48e939bc5217e87b2e211321280f2a09741db300f7010f631faf4188228df2510050434278d44e0be5a3eaf70dd8ced6042d585361e4f3fbb43aa89bf35e19499e0cdf2134ddf56e0b1de591e9aa0120aea901c30bd87bc18042428c4b87655c593737e6dd5e9f315b1ff6a3e24945cae35a1876db9ee6fb99db6548229c5e0ce7ecddeb19112219261105de0e7d9bf995841e014bbd3ac006fc5d53bde"]], 0x1fd, 0x0, &(0x7f0000000300)}) syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') [ 3404.379952][T32058] binder_alloc: 32057: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x40030000000000) 06:14:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x200000000000000}) [ 3404.513304][T32198] binder: BINDER_SET_CONTEXT_MGR already set [ 3404.539908][T32198] binder: 32192:32198 ioctl 40046207 0 returned -16 06:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 06:14:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_mr_vif\x00') ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000140)=0x8001) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000180)={0x1, [0x0]}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000240)={r3, @in6={{0xa, 0x4e21, 0x3, @ipv4={[], [], @broadcast}, 0x9}}}, 0x84) [ 3404.564078][T32258] binder_alloc: 32057: binder_alloc_buf failed to map pages in userspace, no vma [ 3404.581835][T32198] binder_alloc: 32057: binder_alloc_buf, no vma 06:14:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x300000000000000}) 06:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xffffffff00000000}, 0x0) 06:14:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xf0ffffffffffff) 06:14:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x400000000000000}) [ 3404.752782][T32497] binder_alloc: 32461: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.origin\x00', &(0x7f0000000200)=""/81, 0x51) 06:14:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0xfdfdffff00000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x100000000000000) [ 3404.886854][T32745] binder: BINDER_SET_CONTEXT_MGR already set 06:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0xfffffffffffff000}, 0x0) 06:14:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x500000000000000}) [ 3404.937308][T32745] binder: 32715:32745 ioctl 40046207 0 returned -16 06:14:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000200)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, &(0x7f00000002c0)={0x3, 0x0, 0x8001, 0x401, '\x00', 0x4903}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$KVM_KVMCLOCK_CTRL(r2, 0xaead) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x214000, 0x0) syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f0000000180)={0x5, 0x7fffffff}, 0x2) openat$vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vsock\x00', 0x800, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="7d4484c8e445ee07000000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:47 executing program 2: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r0, 0x80010000000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x31e, 0x0, &(0x7f0000000080), 0xfe6f, 0x0, &(0x7f0000000300)}) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40, 0x0) [ 3405.083879][ T437] binder: 412:437 got transaction to context manager from process owning it [ 3405.095482][ T430] binder_alloc: 412: binder_alloc_buf, no vma 06:14:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x600000000000000}) 06:14:47 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x200000000000000) 06:14:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x2}, 0x0) 06:14:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lseek(r0, 0x0, 0x7) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)=0x0) sched_setattr(r2, &(0x7f0000000140)={0x30, 0x3, 0x0, 0x3, 0x101, 0x8, 0x200, 0x3}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3405.277630][ T673] binder: 657:673 unknown command 0 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x700000000000000}) 06:14:48 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x300000000000000) [ 3405.313274][ T673] binder: 657:673 ioctl c0306201 20000040 returned -22 [ 3405.338689][ T771] binder: 764:771 ioctl 541b 20000180 returned -22 06:14:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0xffffffff00000000, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3405.379974][ T771] binder: 764:771 ioctl 8903 20000000 returned -22 06:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x3}, 0x0) 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x800000000000000}) 06:14:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000005c0)='/pr/cIpv4\x06\x00\x00)\x8b\xdd\xe0\xef\x99\xbcp\xd6\x8a\x9b\x00\xde\xa9\x00\x00\x00\x00\x00\xf0\x9a\xf4\n3lcr\x13\x19\xc8\x06K\x99\xaea9\x8br\xe4\xf6\xff\x000x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="09631040", @ANYRES64=r3, @ANYBLOB="ffff1f00"], 0x0, 0x0, &(0x7f0000000300)}) 06:14:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) fcntl$getflags(r0, 0x40b) madvise(&(0x7f0000004000/0x1000)=nil, 0x1000, 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f0000000140)={{0xfffffffffffffffc, 0x100, 0x8, 0x0, 0x6, 0x80}, 0x3, 0x80000001, 0x6d25}) 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xa00000000000000}) [ 3405.572755][ T1094] binder: 1092:1094 BC_ACQUIRE_DONE u0000000000000000 no match 06:14:48 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x400000000000000) 06:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x4}, 0x0) 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x2100000000000000}) [ 3405.683089][ T1279] binder: 1278:1279 got transaction with invalid offsets ptr 06:14:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4, 0x84000) sendmmsg$alg(r2, &(0x7f0000001ec0)=[{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000140)="ab69b1abe210640f499d80e67debd8781ee48dcbc640a15dcb8d9625c1bf25f5c34a192937268b68f1416c33fbaf84d357889cc01507bb4fd7aa2807970c0f7cc8749c5a070f512ac9c50c21a1cdaa0430b88161779601c15d092372526c75658dd06063de097da4dca50a1e644fc278d7bbbdcb43b22761c636d6fb", 0x7c}, {&(0x7f0000000200)="5c891fc1fd87d5b5e7b5404725b653b4eab468d8dfe91f43d552329b802ad140b51e4bdc58ac8948091f600c537577ef4aecb905cd020a5a3cbef42b0bab91aa28b6818b3a60f32cb146ef784fd6264c23edf29a6ffe544f696cad5c903baa26321e714b2efd04acf91b66f0e4af20ba41663b05adcb5b10f834391d6bf25360677463bf45ff7c3cfdedd1c7e608ad8ce95c35a99310997db73abd038bebc38d6ade060c539f33bdf6924b5b6c2e47459878c712ec4e81b09a49ccbb014efe28a4982e2cd3a97bb3f3b08d49c342c46f99341d7dd3d0dc235ba7db14fdf5bc84e145309ea8ccf548e85a2212cc", 0xed}, {&(0x7f0000000300)="62eee34768ef1fe5a7632c2e7f79adf6598daf5ab3423c085f8b6f0ffae1564c81094a6a607928037a162d662ded857053a20f94d5324943c286e08e07f5530ae5698560f747420676a735562be7388bf9e2ba116e47d479e18e73dc07b8e6ba19a9905b63011cd01baafb0e05ea28da92f7cd119d96cfa63e8d4e053e70fa04105a292a626465b0099291dd41fd3f27df58c639e0cb12d60345d0c36a3617122ed968f7aad2980bc49d87a9eee6f752bb4099f15ea962845d2034c75938c134e275dc89df4e01e9b76d425a15d357ee01853ca5b4d7af49bc69e2dad5a437ed8ef339b2f1748142b3bdd2cc97221f401b02e5c95fe434eb6df928c291e8cd35a3c5d3fb64e96d521375f147d48c328849ac080d7f8f7b88d6e9cf5f2a2efe814ee129706fbafd8ce00ab477a607f0d215f5a5a4716fcb52cc40224e07fb9889a10c24710b6b340aa1cca953e0746ab898b6cae93f00c5e7e31bb253bb7aa9b163b59f8554216e353f17646f4168a64344396a8ee338b604865bf221c5589f128efbd0adfabcd9a4f97028cf3010b0af235b3782d6ecad6fcf699fe553b8ec8a13985e943cea264f95f871db6efce13fc8b064a3579dff4952b315d77f14331a40addb08f0b3f9cbf10a7dc403035ff35254c10a86e3fbfb041d5e2709358d98543d8be9700fe7a87df6874ecc29059e61f2b27eb16db07f308585b9d545ae089c50ac79d9f961eb262afdb3ad55763713a9d1269a98a664e55fd15d751bd2cb0011bff45b013f15d1a3a4d1ae2856a2197d0efd1aeb6ef13c6e5377b96b778907337278744d9226faa8541f43c47f7acfd1aacd3d00b31c65c3de766073facda67bfd33d95ee66c4a0f4931cd6971023e130f52c79029cdc0af275f5098b4274c8ea3ca070b3c311ab3c1200f4ac9f3b59e8fa5df44009c2ad9fe30c4831b9619a9bc2eca19f2231605c0cacc8b44e66ccea9ccdb106307dd08d4799454b7fbe9580bc8a4746d1af44ec21bc2a7eec5120dbf789fc05a37594010bc35fe08704e7c7e236fec94048d96fb9f24495d6cf11b766bb583e6ebee4db9f284e33b3478cae95c514a79751cb72e739fcc976a4936420a233b7ebf0c5af257ec6f8958adf033b1759c815dd127b9e631cc0ad3513db674cb0b4afc7eb37d7a76e615e596532fff719c2d22af0f3aeb99d8ab938cedfcd25da9390020226ae50810fa233fa3cd0fb6aa53c792560ab30293fb4379ae897dc254e7bc561a6f7460cbeac0e467847f0dc51d0ad87426cd66406bc91df233143ad25d08723d01c91ba7d46affda0f9a10134ea268d42cdfa42f3bb34ce392fc2f8f00d53ec9597b44763ca89b0b53fdee4945a31f417716e13a98fb3453e7ee015b78f475e76f887461ba7dc0e2baba35796453a7810f40cce6ad2bcb85ff550f1c5b646d2d7b4e5811d370054fb0b356dbd27be3602928ee662303e4dd6d41fa5094cb29318fad88d2e7d717243f33be1c0770c9891ff55a4c63dcad6ffbba957097867b304ec31cbe655f10dc262683b3b4c8f2060249a37b8477d749d1e06c221b5da734c80f3048e148e43866d5ccbe955f2a1dd6173a7f480ecd11c967a85d0e382663b480cfd45efc5439a3e47e0169b960fbeb1e9cb76e043df2649e6a7cb65a782cebe038deca72fc906ba862cdf958b0c65c448e9b21a43caaa74c9bc430b465474b8d539efde22f4a166b5a16fc4be588fa27e5b6797bbbab5d1b8e1817065346a0c7ae9662e58ad71eeef93d8d92a737077ed33d55701b50889afe35158f2da6b2d3c4e77cc7d488b4c96e023f726a2df748da9df73f3eae1c8bc3b9e3af84b8d9bd7da5610c5cefa512b5686a8819ec4d51557798f9e5d79ddef3185360b0da4554f363bcb1592b926aa62a75251c76d0730c792b567b8747dbaa6a9ea315acf8862ddeaffc41c1a5232be5973815d6a867dbc8b22b7f274389104b7ea1ba1d74c287c4d8f5fe00c33f042abbe060e049e54dd9a8af390aad6ff0c9fee86cdd756104b29c05576cf1d63a979e6569b31785b8e472565ff862c8519ccd197a1bac655488be614709ba5df7ef8bc20a70fa4e204ee27791b8c7d8c042d3526655fc5bf3cf765de23f2a6be0ab22f07a7a140708195f7fd7bdec59c15746ffcfa8002226a8a8554a2aea98ae4cd77d645a855603ff9ac9ab6784e4586fd77e3bc4a93cbe1745934a92ac0ad5095d02f1fbcebbf715a1955f43dea76d2d5ce06f8974c1b210f459dca091d257576cfbe2c01a123aa18e88375980a287028ee25298c42884dfe931a62b3a9db77ce682033fd4e6ed50e293daae03a073bfb1c16aa484303ac3a0ca4fbe5a01a618bc482bd912cf0feaa18565faba58af9cb03610aea465a4b339b98b60313123a491f0ee6f2719dd8929744e294d5ef956f5469a31c248ce9a2d568fc5ce2f87e7fcf8375033e7e49d968c73117162ba0628b226bff1c9237e4b37b0359d45da2afb334e5273991262d4b45047de95e797059b1c665a4de6d28b5c0f43664f26baaff6c52ced8ebd484ce5fff177865dde013dc4afe7d9f500e2ca13c2d3dffa54bbbc0636eb8ff23892013ea8ad3b22ed0fb14991c37c515afa2b6d7e32d8e5fbc00417770847fe08800fa9643b8f086de79aa19493def9b7696311ec22efa4c775f9104ae09fc67b1e28e0c2b6fe579b2c6a3addfc528c4e5c3f8380c1b808de47caadb7f5daa7d2bc85a1ec9d4d1af9786d22712d0632cb9cfab0f765618224c1cdade021b0dfd009b441d33cdb9bc147a79de6f554f88c866b36f44c7844918e0a1d42999e1080c5ac7dd24fde7b0688b615ab13baabbc93958c3650758c75e7889370a43ea3cb2e84425ea48d0fd9126811c3b3784baf672c20421e182c86fd6f4e33ec13315828ea54720cb8ebf4d42a12729242177ca994eeba4e6e76e8a10baebffd0727d8777482da9b9321cea721110292df5f6996754169148ee745dd8a2b5d98cb96b0dad2e95ad7f42f2bfa90ac18992ef0a75dca3a94fde9dce0eb4bf427eb97de948014ca95d07b5f7c45b1bdba869fb60c0f69ba8ccc8c07b59e1d650898f4672de4bc8362272ee665bfb7532178a8ea9c2c992632bff5a587f45b2d3d8368a8c154d453319aec64110714657109a690c901afe07b71f45881444be671cde3a5da20601a3994c037f552f8afa173d361b14b156ad8d4f5f7374eb48f287b22a54c41f88f478f00113dacf83637d649f2dc85b9e4748fc731a0c901d738dd91017523b5566ea1176f22cd97a0117cbaad5eaeb7b023a2949fe7ec0b7b455976dfad081da5601c09749e9bc8ca9f882086730f28a91f2076bd1d01f573859ca441331de7bd1ffefb25ede1f9f085aa7e9d220dea164fa9feaedf22c0bd9aa757773d8c5dbbb11a5ac8dd1daffadb00e198c15e93d69d75cbd01a394ce8a84979d7480d4e1268c8ef791666e7ae2885e94e6259513bb53a0c2aa769d72e5b6976b06aabd5fe61c2c7628c2196f0c11c7d1f112465c076203eb4d90a185e4511d021aff1e172967ac98f85eb7e28e2c35a310219a4e0dbf19d9f7fc0ffafa57b1ba61e37ec020825efef6fa47026bd2eaeee4147f2eff5a91125d30a59d858e8b51afb91c68c21502b89794767e8cd8dd51e87e05aa9a3e6e5a8fd2cead93aaf8d3b730a2c8a00011d9a289e02b68fff043372439553f6d5a97f5c262f386fde2cecb4f852864eac2f4fd08512b927fee854a85f3e29db382b82225c2f2ddd98dcd7c50d625c220795f2820a34324fdcbed421d17a170a2090436ae9cb6ff8e328b91035e16e71319799773c4b4f7a87a8e36ebd4eb726f6af3556a0914447f31c9a283442ac12aa6937243716efc88a591e0e35e669fb4b9ea74dd815bddc58fa12a026eefb91f17fbafa8ac7d2e5e5c7dc3118ac6e3f22817e2ea25186c0d62b8815bf9d06080ad8025f361420274d66b7d2b75d1fc1fdcb77e4cbd1adaa26d76f42169b2389e20d232ce870cbe2fe787e1bab7142fe15a8adcdc42dd8b6b032b03ee8fa933e631edbfbf5dc8b4d0e113e868875045ef6f854e8dc2d2a32b2a451746ad3dde2f6e7e72b545d660eb9d009716eddc61615decf19d25c4b96b8ff5d785eb5adcaf3a74d4fbafd40aa97463a857dbd85ffb6a67cdf8e86798cc6bc6cdd3e77db3414952fdf32b46bf8196a9bc938de018fe7efb49b6db0d0eb1ec9dc00557a6eb6211c9d16509117efc6913ea7124b925510584959e5f5b0971f0196aa6bf0978456137cc4fdd3f1bdbdf1bc7134fc8c705dc19af44672701c5ebc0fea7f2b15362f9c97e515517a0ca9258de167fa524014347f6c3665708a9efed063a8b5bfe1886057987abb92ca2845e893a7d61143c896e62d4547b6dcb3202770fd1e08bcc7a42d994cec0f9c10e135c9e3c8d685db039d9cfaa4810768b52f75738a7e2a4ee568f85903eb59e0a0e699675ac886f41bbbf2852db54ec4d3cc9a38fbfe16419f571680ba29d86cd6873ed2085893b09ca47a399437f037d3b945b207be871c50cf1ae145157990f92eaf72926eb0de93f1550e6b244924051f931bbe2cadbe36c039ad26d7ced372713c3f7e56a6e2a43ff9457e6fb0cb9d574b096f6d99ea03db548e18448d55f422682582fbb7159a7e65906ccbd5e67701f153a26ebd08f739d73f96ecf7c5412acd3837510ce664f338775a996d28444ec224130dfdaa4c59b782262dfae3bc0c054912b10b8030ae30ae3897ebc43ae60e82a26802c3839171f5182c9ba38f51401c6b5d2b3d45d2d0ead3ace6c898f7f467ead0e05dde62d4b01bccce6d1f87e6d3934c7cf5c5ca34ca06ad113050e3fc348ae4aa931848a3625010b4c642ef780c7af913bfef6d1b445970d90a1c1570396546bcb28c979a56c5e14501765a41bbb666b4807039ab480c77c81de26e998350746498c5bf45b27479dd1a2d778e70e1d5428c8e4f9296f8bd90ce31ead0f1ec49494d30f3f9f6862807f60623d4098e6e244067e369da07a40b49c2d160e000b70f4c4479b019fc64e440814039cf543156acbc92a6870f810bc0a1427f48a7ed7329837a43ca8e4960ff66eb610db6691e55f4a63eac32bd4cfc7a6778f6e096071efcf5ac03a0f655dc81ac1a0b0e13c6c45e77d8e465348b58b37ad16b32a28cc7d52be82165df560b557a5feeb92be514dd4a993921a66bcd3e82309c9375d5dc4d5e44ef5cd1d55719e38bd345cead417a458dea182cc3d5eeb2ec961436c1b7ec88b90754f581bb3fe6f9380feb22c05028923ed8cc49fa30eccdcc39e0b59ae86992af34665769047cd5f44bd6698053b7447268c33db1e6c8af896ef817e2e3a5d04cbfd12967566fbdd84a80fae6f2ab2d8d2e765fdaaf4bd5dcc7158a750f82c5aef0803504777244f24eb095a33d9a871b3d4689ea5f155cf8fc02f08c6df640cd5ede547e32dd82fe9e4dd017687dc0c1393e15fd56b1f5d07b50542131483457f0bf13401ee38cfaf298aca29d618519cf75dcccdd72ffbc79cc1bbdfd35b66ed15df9cd8280b208bc3e88f0ba0ea243bbd3079a5a189e73fcb7d6316d94ccbf661b8928da44cb424d9ef5058b7d0c7d8748960f3e28662e3b489231d2eb3ba616b4d053272fcf57f33f74078abd738cb33abd1ab3344de309ef49002324d9ae0ba63a688217c06118b5d67a641c33995c4696a84c00b060d8f66a81c8f61a94821d8a80a05ed4298381b7064ffee929bd99dc467dc6a9231f0732867e8c02f26e7477d534f1078c43", 0x1000}, {&(0x7f0000001300)="aebbcbd126b89e187311f59467b3495b62834cfc951b60b761ed863ecd3e8e7edcff8c398aefad866903cf6e48e89b010a627447e940351b212bbb833f9f91bc049b233cfbfb08d5127fc38cb201e5f01b4d7a827eb3b55e0d174253eecf79d850a3bdc6efdd1e9b0f02c95af62f670c6bfed8318d1bd26e86bb2654dd1a0ccad8ac40ff7db318048f523bacd955bdf1fa3781ad73dc2417bc58337541010cf0a8aad0a0daa20c83cdf89a01f97f074a3273dfd86c0a4613941223070eef04264abc5efb54767479eab3b353d6ed9223d8a90c906a319eb08bd7d4f62e8637e4c756e133c145f278328cf5e8604439a48f09053d1e3e541b2c76ff", 0xfb}, {&(0x7f0000001400)="c883af10cbdabfb86fa8c202bd416df8157e65406aff377e21a3944905406bd1339c12a6f5b5c0d3cc477f1077f536e5207124ac4c4c0ab45603f526db1aee42cf", 0x41}, {&(0x7f0000001480)="f0a3be491be467f7078299ca14a03ec94a14bd310080485672123d47a4238aa369b8c8079d157369103e56de5ce6cf90701ba5445b5178", 0x37}, {&(0x7f00000014c0)="a7c646d08a2cbf126fa21928207b8ca1a5313b3e130c0331be91f436e71b4d2d4485f75a53805050234fa80289bb15ad415dbf0a265f18a1fdd46f8f048001573f8270c258d4b69aab74a5a02c32851fbee42172ba177cc517de9f4fbdb6f501f2cbf31da0e52693", 0x68}], 0x7}, {0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001580)="c0b70ad002fcf8e791981aa702e4e828d44bc4610296b978dc580850795909a85741eba889bed781f920f1bf8263d6f64372799b98dac745ce266ea344a9", 0x3e}, {&(0x7f00000015c0)="53fc932d3b78d24a536da65439fb77edeb70700ed609e6e6fad4c99e4afa2221c84d1aae2a5f17351f50d56e834afe2fc6c35c099b70cc5b4974923debdac586a207a6d7a0ffd329bffe03faa7de7de45d39e55ccafb0b52cac5544700495043c75132ff73a953a4bd3a53dbffcb4136ed40da3749ff2cc76706b6aba8ff2f297613a8ce02ce04d9adb51acb0f037cbb360faee326087e1c707f92cddaf787a78fdcc0310544b57ee22b5b52876239cbaff91efa16fa782fe22ea1f862ce56b0bded5522939970fd17fd340b6747114bb160b4a0a3", 0xd5}], 0x2, &(0x7f0000001700)=[@assoc={0x10, 0x117, 0x4, 0x73b}, @op={0x10, 0x117, 0x3, 0x1}, @op={0x10}, @iv={0x2c, 0x117, 0x2, 0x1a, "738068f8ac7e8ba80684124df5720ba573d63ac389664b22a729"}, @op={0x10, 0x117, 0x3, 0xb96fd2b231777266}], 0x6c, 0x8000}, {0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000001780)="fcbdc5c386fa9b3c993fb0917a7a764cf5483b02274ac957583beaa5785de588e91786dee15392aff04213ad2b04c709d3eeeefeddbd977d56abf823b5ae9c8c60d2a0703e0f7aefddc39e5682e631a9d5b06255c0ec3062ef8b1fd1748922a2", 0x60}, {&(0x7f0000001800)="8925315b5e999655d72c09244b06302d48af5c29bde547d44d01b61286cbd6a1ee211f2a0a65e2d9a105a01fffcb4cda6de811933581bece771a08804475e6cfa603a7e7f32d947409c206222bd58b6c66ca49ee26a6544e0b116da572b6e81900a1b949b8a9a5d156d8c0cd42a1ac", 0x6f}, {&(0x7f0000001880)="e614994361d8f27752eedb8777695f1c209f923f4c1a1e38a225", 0x1a}, {&(0x7f00000018c0)="ed4430c19a74c905b6a60731483b02453ac057a44c8879981c78891d506c488e56df6b88de84656e8b75f27d1030c4d1a14352a0a4d2ffb07dd64d011cbc09e338789d63b669a634b58d49c4de8e4ea2145da2226676b42bfff5b6e2e9145fab260d1692487566cbae0ec690bc3b8fbcaa361f5f362b8411546deb22b382b96712bf5e93b4a55cc85c183335a59418627aa1daec4803826ceadbf3d957115af495a0f11bc608874a3f1287626a1b0a1e16a0c13011dc86c5861fa9197c2a981aa409fadfa6b3346381b4e4fa4f22589cf3731c75f1ee55d0ca61b4df7074768f96cf1a6dc84c3564dbe004bce6d5c1bd", 0xf0}, {&(0x7f00000019c0)="e7c00b20eaf0b5b3a8583391055a95ba6ea802cb0a", 0x15}, {&(0x7f0000001a00)="33b91f44cad31be6292369cb79c3a4fc29c4e2acff5c37f4630c9399c54a7c2c2ac027063ca3bcf2ad8cbdec958d09ac335913f483c28e5dc6210ccbac", 0x3d}, {&(0x7f0000001a40)="54852f0aff56431d113af02c2f9a01b0f1ed22873221c7a31a5d3ddb23e519482a43e5d2246ead07b2cfe2b5175c29883cdcb183cabed181e9b68f676eb6cccbd1ab9c994046f312f143a5e87075871cfb3e78830660585e726a9eaf7b8fa0899066b7e4fb64d4b06c0ba4cb25a1c2f8b90b3fcb6d74d78cf2920168a696", 0x7e}, {&(0x7f0000001ac0)="bbae1d07a4c93a553d3f498a3aaebe0845565386e5a2d04532d735291dcc18c6663b4a187eb7ee44772e2f0e06e18024bcb2219c2a059aa91d42caee620abd33edce1960ac5d3ca262d5963f14be1a605f8eabb0309d64d54fcabd1985d511a19b7bcac5fffdf13d1cb6396a1b223cfa6c61d410c0bda20647d01ec587045c9b0ee08a5de2deaefd586059e5cb68aca31f2120f7448604b88503f6e3d6a232f92cf067c1f2786befa3d7d6f79b6f3798968b742904d936e6363550418c4fa7996da183240d117225bbb63fe4", 0xcc}, {&(0x7f0000001bc0)="e78eb57fd1b9e457c95aeada9efebf4cfb898d1a9864037ac5e91fc9ae70458372a4c5630b087a67f8e2716f7a346752b5f59afb75a39336c31d1712bc13811d5c4e74162fc7035deffb9a08a6a36ee3639d5db8cd28bf8e1849b443200411a56fd8c12fdfb96fd3b44cff796f218e44ea3fc6d0383cec35ac85a407510e0c243a5e85e9be69a63de355973818f4f8b96a82b82b9e234d1256c4a59b887a39b48115120a60941a6ab98a511a144b1fde23cf2e1ef099d5a5631268bb0f7a3aadb5ce9fe6e4f29d4d56ff236b55", 0xcd}, {&(0x7f0000001cc0)="65c363ebf3132bb02821507dba88d2cbf6dbd9efc4f8e7db78823c9c2074c899f7c09cc818e5f687c2a322cade4b398300ad612445b26bd8943287636eedc358531799b4d515d6f591ba871a759faeb03a1e10c03b5f071ed802c442aec8b96fc65876ead1b8102c37db9789cca3bda42f677865ba47247ded528485c888df53c9f8e7b55c23d9f4a195e30a7e2ec06922db216419258632f9b6f9", 0x9b}], 0xa, &(0x7f0000001e00)=ANY=[@ANYBLOB="100000001701000003000000010000007c000000170100000200000069000000dcde5818241a311a474f2a0a344488a4fb7a239f2273c6b300ffc0d53e1041f493452dfaceb85492001bbd602a8818835ee2e8ba6021f6cb439ad5f1ca49f6347ec3a5dc571d1a386e9a84e80092422f3fb02b96637f14146800000000000000000000000000000000000000"], 0x8c, 0x8000}], 0x3, 0x4000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4200000000000000}) 06:14:48 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x700000000000000) 06:14:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000000)={'bond0\x00', {0x2, 0x4e20, @remote}}) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x6}, 0x0) [ 3405.905672][ T1623] binder: 1618:1623 got transaction with invalid offsets ptr 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4800000000000000}) [ 3406.039047][ T1640] binder: 1630:1640 got transaction with invalid offset (0, min 0 max 0) or object. [ 3406.050005][ T1676] binder: BINDER_SET_CONTEXT_MGR already set 06:14:48 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xa00000000000000) [ 3406.082382][ T1676] binder: 1632:1676 ioctl 40046207 0 returned -16 [ 3406.116949][ T1676] binder: 1632:1676 got transaction with invalid offsets ptr 06:14:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xffffffffffffffff) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000680)=""/4096) r3 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0x10000) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000140)={0x1, {{0xa, 0x4e22, 0x0, @mcast2, 0x500000000}}}, 0x84) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xfe33, 0x0, &(0x7f0000000080)=ANY=[], 0x93, 0x0, &(0x7f00000005c0)="0a0cb4bf887135a6033ce069be51a750a2ba0fe002435b6e89edcc23302c3b32fc54b246d542092d35d7eff49d1d150b2caae8d4b0a10e4397fbf260cade5fd523e5e5c6fd28289c384d70ab8e5c265da9076ecb9e4ebe6a2eeeaf806d38842153c2ad81478ed87014ca39290553b184c8779b49d0d513995d27e6ef413d7ce8798aae69391ee1437eca5d1e000100005e5e8d"}) 06:14:48 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xa}, 0x0) [ 3406.142847][ T1676] binder_transaction: 18 callbacks suppressed [ 3406.142864][ T1676] binder: 1632:1676 transaction failed 29201/-14, size 0-12288 line 3193 06:14:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x4c00000000000000}) 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6800000000000000}) [ 3406.276519][ T1987] binder: 1984:1987 unknown command 4 [ 3406.282262][ T1987] binder: 1984:1987 ioctl c0306201 20000040 returned -22 06:14:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xe00000000000000) 06:14:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xe, 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=r0, @ANYRES16=r1, @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000300)}) 06:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xc}, 0x0) [ 3406.441495][ T2259] binder: 2258:2259 transaction failed 29189/-22, size 0-12288 line 2994 06:14:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000008, 0x20011, r1, 0x0) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xfffffffffffff9ea, 0x901) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x6c00000000000000}) [ 3406.485215][ T2267] binder: 2266:2267 unknown command 3 [ 3406.494939][ T2267] binder: 2266:2267 ioctl c0306201 20000040 returned -22 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7400000000000000}) 06:14:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x3d59000000000000) 06:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xe}, 0x0) [ 3406.576065][ T2401] binder: BINDER_SET_CONTEXT_MGR already set [ 3406.594901][ T2401] binder: 2342:2401 ioctl 40046207 0 returned -16 06:14:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x3, 0x60000) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000180)={0x5, [0x0, 0x5, 0x3, 0x80000000, 0x9]}, &(0x7f00000001c0)=0xe) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x80) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x81) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$KVM_GET_FPU(r3, 0x81a0ae8c, &(0x7f0000000300)) setsockopt$RDS_RECVERR(r3, 0x114, 0x5, &(0x7f0000000080), 0x4) r4 = semget$private(0x0, 0x3, 0x3) semctl$IPC_RMID(r4, 0x0, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000140)=0x14, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000f23d7e8c84aea03d000000000000000030000000000000f14da779aeaaa93bf8157e3ab3da295b374b60abf461c73466aef97d1c8596f539b54d5c9f436833db966bb3f15cebde184f9af342d2549a468d739399cda9bd0ca32a486e0d6c637a2a359e9c87b388e49b122c110b5087a8efbf7c17210b3a2091025dfcd8430faea37f258af3fa3c12e2d37db89979f3495e4070ad272d004998fb7bbfd3710b56b1c7c50ba172a450b8696d89504b8174d2d5ab1aad89813672a3657ae28a3538f3d55fc8a5c7ab2813ef1ece3e9e789ddcf4c4", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYBLOB="00000000009b00003da224368243fdea745cb84da9c3cbbe0a0d5cb2000406e8f6e8fa2f09a2c83437e28842bd13f5da9340d0bc360ec1fe80a0251366454fb9b397e918669d76846a55"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x7a00000000000000}) 06:14:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r2 = getuid() getgroups(0x3, &(0x7f0000000380)=[0xee00, 0xee00, 0xffffffffffffffff]) keyctl$chown(0x4, r1, r2, r3) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*']], 0x1fd, 0x0, &(0x7f0000000300)}) r5 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) r6 = getuid() stat(&(0x7f0000000440)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r5, &(0x7f0000000280)={0x90, 0x0, 0x3, {0x4, 0x3, 0xfff, 0xffffffffffffff00, 0x101, 0x1000, {0x6, 0x0, 0x101, 0xffffffffffff95ea, 0x3, 0x94, 0x401, 0x6, 0x10000, 0x10000, 0xc8d, r6, r7, 0x7ff, 0x1f}}}, 0x90) [ 3406.756503][ T2688] binder: 2676:2688 transaction failed 29189/-22, size 61-12288 line 2994 06:14:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf}, 0x0) 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xbf00000000000000}) [ 3406.857634][ T2854] binder: 2817:2854 got transaction with invalid offsets ptr [ 3406.884762][ T2854] binder: 2817:2854 transaction failed 29201/-14, size 0-12288 line 3193 06:14:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x6000000000000000) 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfd00000000000000}) 06:14:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="a74e80d76104cb68"]], 0x1, 0x0, &(0x7f0000000180)='_'}) [ 3406.974274][ T3028] binder: 2970:3028 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:49 executing program 2: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1, 0x20880) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000180)=0x166d6580, 0x4) bind$isdn(r1, &(0x7f0000000140)={0x22, 0x7f, 0x6, 0x80000000, 0x1}, 0x6) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000080)={0x6, 0x1, 0x3f, {r2, r3+10000000}, 0x3ff, 0x6}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 3407.015905][ T3028] binder: 2970:3028 transaction failed 29201/-22, size 0-12288 line 3241 06:14:49 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x10}, 0x0) 06:14:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0xfdfdffff00000000}) [ 3407.133635][ T3144] binder: BINDER_SET_CONTEXT_MGR already set [ 3407.140074][ T3144] binder: 3133:3144 ioctl 40046207 0 returned -16 [ 3407.164943][ T3144] binder: 3133:3144 got transaction with invalid offset (7551134018490617511, min 0 max 0) or object. 06:14:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x31f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000044aaebe934b6e339000000000000000030000000008c02", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="dc48d7f4ba5a2d913ad46ca63fd18000"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3407.186961][ T3144] binder: 3133:3144 transaction failed 29201/-22, size 0-8 line 3241 06:14:49 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x9effffff00000000) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}) [ 3407.297597][ T3528] binder: 3527:3528 ioctl 400454cd 31f returned -22 [ 3407.335256][ T3528] binder_alloc: 3527: binder_alloc_buf size 183521684815360064 failed, no address space [ 3407.367650][ T3528] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3407.390122][ T3528] binder: 3527:3528 transaction failed 29201/-28, size 57-183521684815360000 line 3147 06:14:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x60}, 0x0) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}) 06:14:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x10000000000000) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3f, 0x600800) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0e05403, &(0x7f0000000200)={{0xffffffffffffffff, 0x0, 0x3, 0x2, 0xc22}, 0x7f, 0x1ff, 'id0\x00', 'timer1\x00', 0x0, 0x8, 0x80000001000, 0x0, 0x5091}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) write$UHID_INPUT2(r2, &(0x7f0000001340)={0xc, 0x1000, "130375a6b24f2cda1d3bf2190c4cb418217347d95316e3e6626030d3f3c7997479327d9e197dc4225891b4587d8b013d178a4a989af6e7ff046263e04b8a424370ebd88ca3291877baaccb37587b8367302b92d97d5c6c0df27e0b7af0c69da4c4f390566f0a5245bba0d89247fb33a4592843c40401a966d5340a6a565cbaf9bc8d144976b33d86a2a79ece38750f1775745b539d5d9e38ca892150e20fe53eeafe0f99ef145cf2876a050b7fb098e1d8bc58396807a7b1bc129bb9e52d02cc13096ec71d07461230252d6829c53493bcdaec28b888c08d5de40446370c24978c5dfb8e2bd3f1969c64d75e5b9a460e7f0641496e7576fa683d18ff080461b7afcfc6880e4dc34c1a7f462263fa81f6a394a39bba19948b96d0d3db3172e91a9d8bc9c92b7c1d1f52dcabacb77a522c5f45f2be98d6e7f46dcee49bc8bc700a1487e2ae8f2fff9e8976c0271b7381c0232164716b21a70f00a0dd8280bdab9ac32b6658226f7cfae92a2b45a0d2a60278a5006af149f4d78eb1a2385ee776363b6ade9d99d7f300792ed7a5ec1db484c60d10ac5f8f71110eca5076d2791a47af13dfd5ec2d9683cb513089ac1627b1a1402481f1b91129590e5b50775efd1fb2f870a17924c22e33a43286d1786ead5527472f2f43e148e953358f88226b6b5096da6cd12d34e11dbb7911aabbe2866faedf869ad2dae8c9d2fbbb8dbb9e75e88757ada7db9fa3748ab19be6de351d369553c6617547715b85daa74fce9258889ea1c78f1a42c4523ae3a97e85015c8f7369f4f7625a76e954856beec0116284c5c7a34d390d01ce63803098b73708ee1453725ee56feab7da1d849b4f1895c399c817c197fcc44bf3baeace34d6cd0d0b05ba6e0556de5b19fe1e0c3a462035f54419e7b66b4c69420a1fc460248ec08503789480d6f863dc0e232f2e6125709e9ab3d677062cbed901a9f256e04b7241ed5d32583b8802d7cc20504abbeca43297948c43ffccc931a0a34bab025747f5bd75a3228a98623d0e89e38b712a3b6970bde36dca84ef87226d049739e1e0abea78ca6f66fe6a3f0c5c2190facd847f47ce9af6c56153cfde7a6b269c773140c1c0b44e8c5bb6104496c8e9aa4826a45c70cda788779788ed036c84614f3274c65a504fa79fa956801ab5a21c8eb98a0195c8e9f9f6dbc0b3e00534ce9169c60e3518c333753ee7628935fa6fe6d8b49d62c022328969fdfd817e1c46bc2967348231562292941ecfeb5cb84e7359d6d430368b25a8bb07c6b6985f66a56527b3dcf0ceaad91b4eded2dc346b3815a23392a8931e5f6f23042997b1ef8446d41005d57d8707cd9b5b81669df0a476d99a0fcdaf5324b32d1c6df2f64d3391a59c88dd801b8d7d6b6aff8ac2e13dc22593564c972303c73ae3fba6981038384c15d04d557fd84e40fef5e71fdee9f5bf81d6a560f232509ac8b97248419b0ea9013987ab1f1e70af1f56d869454f6fa2e23be4777cbf00e896150e3697ff706ed38cb4aff071cacc177626d8efb1e60de197888431c55b23672bd698288c3d98109b67a2d1c3c9d67c409ca4a9b619c173b511b866a800ef8249676a17a57b2b7afed707948d0f43a44c4f1074ce5aca2fc49d731b75cc78c84d715e15dde6c3cacb9390020ffd4173b476aac1eb6a2dcb0016fdcf793c9b7e768a133c594d69159278177ed53a8da79f79b046b21d0fecd29dd141d3fb87862ab53c6bfdaf7c930915238eae3eb14b29a739178228d5bf833e49cd84d0878b2e60ae50a2c2c59e28d6228f86dfd55e132a07bd80d6d200eb4754813db14fe9f04bc76a512ae21db32ee0e9f50a1cbb19032e34e6cda53d8d7d8778e95011526b02dbc18c452c17855e6f10dffd0f727aa18061d269e12cb6f97f33dff9ed391b0e60b9cf5dd085ab07ee839c04677f89bbd065ad0b8567ab912d042493a851e867391bdbf7da8128049e131cb844864a3211b33e49d79c48a6607e2b16fd4710d1b160a74321257f144413c4cb4d937df08dedce68e75892b58d87ddd0b02278e9443c2bb17963e4c44a730e619f25b371f9f9140eeacbd5b4aaa1e8d2370e25bbbf6d6f1a52911d28c063d6f1ca72e3e304afc5d483acc9953bcc49b60568e4880dde7caadcb2af52e922e8d2ae5a6762cbe76644f65746bbf482feaae3fff5c4198c0355e6d8d569ce5b4ed90dd14f8e3b6be12ac5f2ea6382059c22278aae105061c68b6a2e1b0e9815f654ba11dc2ee41983b2d982631d8173d71ae10b1812b2b8991f7eb1790b7857821ff7e2203bed49ae8fdfa62b0cfa21d337cd20f1d2fd6b73560cbeee57b14b74d3b2ff2a52ac888b7dd91665a0815e14054f5a9581c91123ac1d6351f896d149f72d736ee8c06346b525b9ad04450a6fe733786915181a2b677982c035865051b44cf1be1d92fb55ec242f749c2bf273fee3e88c1d889f754089e8a3dd4838b02c77845e36308ec83a4a162e9143352f4fb918e341f8e296889f4f405a974bc98a29b9de8f4af849a975dcc8ad22625f845124e57b9f2535d05a88cf5d3acabd8b518378a60bcca91342b875a6aba256d65f38868cf9391b5dbdce080ef131444e6e5031e827d28a9c4aee6c64db1de57ee0e9718b7e86db4950015986ac0853ad78f53520cf328f6c1f6af8cd8db609d208e82de8a53e7491ac93d50cf5ef2bf0f2e6242007e43919949a3b76cf9a9c86261e01051339cdb7945f74d5b0615c2377c9fb15e39c7a04d8d45dd02b75ca37314981cea290c0163ad0c09c87e20fd766bc34397bc626b0ce2514ee39abe4f9063558f7386df2306d4d3313b048abb8842e1b9ed0c7e94ddcd18e035c734ead7387560f96d8d2e960c92b73a508007ce23708712fc74b7de13205cde1751b7aaca2a323cb75aac20d5aa1132031c3ffaa0596df75b4331f9c303c7aff229df59a773e38137ae7fba560e1350a81932148421b8b3cbf0e9f09876344da3ae749b652d83fc6a37d664efa415687c4f093d9484c3c73e5cbd2a097bc4e09abb236ac6eb94facd3887644f4d3c729dc8f16a3587669548669398397f657119212527aa1f77482cd70a447afa8d48cc5ef5697024ce51f97eca73af87df548887b3d2e90dbadce7cbbf9b552e0d627ae94c21952846e17511fa0bd66ddbbbd5b19dcf8588e32a5ee1c336ebd7cc639ae7f96f830870480c3ebcc46d3edb471c44efb1219b0e5aff47406b12dc924d5a66b7c21e1701672dc8df7a20dce717e14f034f54b4d218c5a2fc4ffa2678b1e322a686b6bbf351e2162cff181f6cc069430a7e736231e7feaf5bc08400d85b3af4e147af8ad6fc7dbb53112d4f1256b39d04d392c84146dd247adef4ae2fb8fa4c5100295e22337104df34317a764b9e74941b8bfc3ec62a8b5255a70f5f718c63704ba2415c51c56e6ca2fba9b7e6980b2ef4f2ae470a270e427078ba6e78856e080a2ac891e470c6abb92b41484f17143d040088ecb6cfae03da8947f2afe9b35f43264b1abe05ee9da64ae1f6d8c30809caa463b2aad8ce2cc339273d2abe84c0cc31c789517df07b1cdaa344b60d634a6b5fa369a3e4e7b7f2cbba99d16cde8c5c50e2f93812af84ddb0efdf5999fdd9cc5a2b012a633f3c8c863a956538dec57f02a85c8e7b20bfeea1490a037022c309dc362f7a31152d01c2594a614b24cb4d603d5f4e66837d28e97446af9015dc29cd008444799c515fb3e48972e6cb6b385419eb4dbb84f29dff417c470ab1e72b2a5b8ad98e2d35a4de42ac7957de6f3464e9e38a095c8525597ebf419b5bcd17bf85d294003528b2a10f0a500fda1fb316ab5202fb00feeaf6bcf8122709f97d37beb50c2c473b8b5d40a9c49e1051c188c4501b037cc81d465e288d5b0d2e263ecb45e7e68d42ecf3876494a1c4723f520af8fb116c5666429ea8564bd3ac7adba90fa6387844e61767ec011502ccca801e055322af5b678a9b0f126910a1756a1bcfe103d23ae9fbbe525a32e61f7ef4a11c864c6d3b02fa51f66b26c6ae4b07f5c2ab703e679bb66daca4eb799256025c8e3ba8edd99a409da066b62ad5fce86e884e85a6fe80058bb1910647d7ea40ce77a20d5906823c9afc6ac1ea0acfed2622a0e0b7d4fcb468036f79a1489de71dbd7cffbb1c5dc43b1305bc624ce2a6a6d1d239652d192621c9ea468ca36ca29682405f534655f1c365bdfd14bdb28b67f22f2775efe3891665f25e880a22cb59e236010b8b7cf5c38c3839323bedbdc78a7aa665c27f1ca5cfa4f0db48c0678b1d0b4643203e86ab6e0c9fc0b964dd99152ff953dcdf10a1073db453edd7337d9d807cd43170375fb703254206cd437cc4c5012689d4af7d3af8d5b863d7b074d9d5cf918885dbf29715524cb0b3d2a74be5446930743a278ca4ffe792e002815740abfb5b424f0b23ba0835d4e1f97bf0731350e0a544da7f0d35328736efe1a6aaee1a74af7fd4e55b9ee014321541f8eae149d58cbcd200353987691d6849b4add190967635ce7b83823cbb14c41697ee921cbcdea71eac5e2a87bfbd1ff5e53865b68e068d6cd159f022b6606d26dafbdca0b30a3a8b364c89684d01dc66a5adb41a03df35055d60a445a3347e5633705336b059cfa24ce4069866a0c7a15193c72b8b1beddbe75b00bdf308564a1f1d307f05d14d90fb7de6af73d0102f9c0030f83ec38c18b32e37adc11585e879b9d7b86f8eb0d114551377139f919387d831d933c022c80a95f5f3de92a2f66cb053128e7c0d308738e9d47c02cedb925d51aacf7302d27dd8789c527e8912379fb8e0e162aa3b0c38ccd4f0650ffedf13226ec86b4053fcd82de6a7e152bfd2ba7d28f4606dc23f2841ae5f08d331d835482c5ccfeea33d270be7c261033ae524dc493c5ce3d26366fd1482cd71524230dc6ba6fd6c477552890074982ba8446aef544683924efde7a1d80cf73ed4d8e844e322ffa536e6083684283a280f1786659916c8473864c711fcd39a523bc3232b6f847494d2a80946537b1d47a9838af8f444a14db7b63de7a42a959ed88a6e7086c50794a35ee89294620f38025ec37610dbb7e9e20b11a641c09c7f781e8ab5532555523d195d875f54d1571c1e3e3df4485075e26cfb714ec4461db001a303835105177b4d16f99349599bd40b9bb12e79e0141a00222c567395ec1692b463fa5118b2613e217ac3a243d1d4b3d049ac3367d88b4cc28081ce68662c85925bf5aec062f4e79164f26231a01f271cae789086e76b483d1e9ec7d4f26a7b9110278b8b58078c7bacd2068c3961c55591bd10fbd7db54ba9500475489c24332855403c66877aa8cc7b60a224937bfca222a7fefc1a56c2f8f9f919073ecacf926fc1f4c86c2bbe703cd11a7a0ea2a554fe83e3b934120d280f6109b033ce1f941870ac20e1f01b6509e1497cc69d4570f33810f82daffd840df963e65ddb012ed89f010bd3752bf5759764ee2b2e861c165bce507af212fe5fdf02c82a8bfd569b900362c5d4d7db964471a803cdd322219549ea602e923c67d63598937e43c83eff20608d74847cffd7c097e65d07a6cd37901e9d6b641a89e6333d769ace5b97d7c662fe31142b66f14615ec2ece8b4da61bc00ea3dc165e105311d427c78b77dfba3695543c0d9710d50e729fa3471f19a35b6643049409d37067b0884e7b45a18514fc4a372913cf1aa045c8cb06b79c46188979fec3b16cedd64117d07e68efa5e92fedc680751f0a4cb690189325348f32efa29b90b968a82f9e31af6c0f6e"}, 0x1006) syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x80000001, 0x20000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r2, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xc00e000000000000) [ 3407.503727][ T3705] binder: BINDER_SET_CONTEXT_MGR already set 06:14:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="11b7b605f31b1c61"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}) [ 3407.550144][ T3705] binder: 3704:3705 ioctl 40046207 0 returned -16 [ 3407.590108][ T3750] binder: 3744:3750 transaction failed 29189/-22, size 0-12288 line 2994 06:14:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xf0ffffff00000000) 06:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}) [ 3407.632222][ T3845] binder: 3799:3845 got transaction with invalid offsets ptr [ 3407.661395][ T3845] binder: 3799:3845 transaction failed 29201/-14, size 0-12288 line 3193 06:14:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$KDGKBLED(r2, 0x4b64, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6}) [ 3407.842476][ T4183] binder: BINDER_SET_CONTEXT_MGR already set [ 3407.886501][ T4183] binder: 4181:4183 ioctl 40046207 0 returned -16 06:14:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 2: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffff9c}) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x210, 0x70bd2c, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000040) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x300}, 0x0) 06:14:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xffffff7f00000000) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7}) 06:14:50 executing program 4: syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x4, 0x80000) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f0000000200)={0x0}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000180)={&(0x7f0000000140)=""/33, 0x1000, 0x1800, 0x3bf8}, 0x18) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xa5, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0000000000000000511e3f9e0000a7000000000000000000000000000000000000000000000000000000000000000030000000000000", @ANYRESOCT=r1, @ANYRES16=r2], 0x1fd, 0x0, &(0x7f0000000300)="5e07c05ef89274e012714af3aa11518ee2da7314e0fbd798770274d06e97789ee6e2ef30a4c96e485bb1ce2d118db3ee8de83f7b1f0dc9c8734045"}) 06:14:50 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x8}) [ 3408.090570][ T4354] binder: 4353:4354 unknown command 0 [ 3408.099916][ T4386] binder: 4352:4386 transaction failed 29189/-22, size 0-12288 line 2994 [ 3408.112935][ T4354] binder: 4353:4354 ioctl c0306201 20000040 returned -22 06:14:50 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0xfffffffffffff000) 06:14:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x10000, 0x10000) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000180)={0x3, 0x18169862b771c39, 0x0, 0x0, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup3(r1, r1, 0x80000) ioctl$UI_SET_PHYS(r2, 0x4004556c, &(0x7f0000000300)='syz0\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev}}}, {{@in=@initdev}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:50 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x600}, 0x0) 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xa}) 06:14:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0x0) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000140)={0x0, 0x0, {0x1d, 0x39, 0x5, 0xe, 0x0, 0x9, 0x1, 0x168}}) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000180)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x1) [ 3408.282980][ T4679] binder_alloc: 4663: binder_alloc_buf, no vma 06:14:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000006, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000200)={'veth0\x00', {0x2, 0x4e23, @loopback}}) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0xcc5, 0x115000) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2010000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r2, 0x200, 0x70bd29, 0x25dfdbfe, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x81}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x4) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400000003017f07008fbda31d88c000001018dd"], 0x14}}, 0x0) 06:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xa00}, 0x0) 06:14:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x21}) [ 3408.403445][ T4959] binder: BINDER_SET_CONTEXT_MGR already set [ 3408.425439][ T4959] binder: 4942:4959 ioctl 40046207 0 returned -16 [ 3408.440772][ T4959] binder_alloc: 4663: binder_alloc_buf, no vma 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x42}) [ 3408.598530][ T5131] binder_alloc: 5101: binder_alloc_buf, no vma 06:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xc00}, 0x0) 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x48}) 06:14:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$EVIOCSABS2F(r2, 0x401845ef, &(0x7f0000000300)={0x3, 0x6ade, 0xffffffffffff8000, 0x40, 0xfff, 0x2}) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x4, 0x400) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e22, 0x1ff, @empty, 0xba6}}, 0x166b, 0x75ba, 0xfad, 0x1, 0xdb}, &(0x7f0000000140)=0x98) setsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000180)={r4, 0x80000000}, 0x8) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000340)=""/87) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x40000b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="d0ffffff00120000"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3408.638923][ T5090] binder_alloc: 5101: binder_alloc_buf, no vma 06:14:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}, 0x1, 0x0, 0x0, 0xfffffffffffffffd}, 0x0) 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4c}) [ 3408.774372][ T5440] binder: BINDER_SET_CONTEXT_MGR already set [ 3408.795259][ T5440] binder: 5432:5440 ioctl 40046207 0 returned -16 06:14:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0e003ff9ddd3462822264b46933011308caf32eb213e1e713a0c8ec19b97942c1e4cf33020c338fea7523aa7fc982989ed1a8f9419c44d0d49f39f602f1e13b7622ccb70fd88bb81e0f72ec148bba6dbe58d9f548a3018a6665a490e79f18e392841a2277e1ca5964b817beff376ae8fc949fd90db408f3ec2e9b071e0c7e80006d7b3c6efedda8095b0c46bf7db732b0103be24fb1ee93fe30299d3430023238a47dc279ff073e9c9f3ce0c653efebfcbb5dda144e34b78b76d101d0dd4e8079463e46aa6786cf99d21f232893fad3369a36b38520b3c7a893773c09c29266d73f04fb8b1300"], 0x14}}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x20000, 0x0) write$P9_RWSTAT(r1, &(0x7f00000001c0)={0x7, 0x7f, 0x1}, 0x7) [ 3408.828947][ T5440] binder_alloc: 5101: binder_alloc_buf, no vma 06:14:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000007, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000480)='/dev/full\x00', 0x2080, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f0000000500)={0x1, &(0x7f00000004c0)=[{0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4008641c, &(0x7f0000000580)={r2, &(0x7f0000000540)=""/17}) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000000005000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x40000, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000005c0)={0xa987, 0x40, 0x8, 0x80, 0x2, 0x200, 0x7, 0x51, 0x0}, &(0x7f0000000380)=0x20) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f00000003c0)={r5, @in6={{0xa, 0x4e24, 0x1, @mcast2, 0x9}}, 0xf617, 0x1000}, 0x88) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffff9c, 0xc010640b, &(0x7f0000000140)={0x0, 0x0, 0x67}) ioctl$DRM_IOCTL_AGP_ACQUIRE(r4, 0x6430) ioctl$DRM_IOCTL_GEM_CLOSE(r4, 0x40086409, &(0x7f0000000180)={r6}) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r7, 0xc08, 0x70bd27, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x40) 06:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xe00}, 0x0) 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x68}) 06:14:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) [ 3408.994051][ T5708] binder: 5707:5708 got transaction with invalid offsets ptr 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6c}) [ 3409.091507][ T5781] binder: 5780:5781 got transaction with invalid offset (0, min 0 max 0) or object. [ 3409.110183][ T5837] binder: BINDER_SET_CONTEXT_MGR already set [ 3409.123322][ T5837] binder: 5836:5837 ioctl 40046207 0 returned -16 06:14:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf00}, 0x0) 06:14:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x74}) 06:14:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) splice(r0, &(0x7f0000000000), r0, &(0x7f00000001c0), 0x5, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x1c8, 0x0, &(0x7f0000000600)=ANY=[@ANYRES64=r0, @ANYBLOB="ab1b26f8a863ec", @ANYRES64=r1, @ANYRES32=r0, @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYRESHEX=r0, @ANYRES64=r1, @ANYPTR64=&(0x7f0000000640)=ANY=[@ANYPTR, @ANYRESHEX=0x0, @ANYRESDEC=r0, @ANYBLOB="9b1724d3a6cd8fc49dd0de4fa304f700af4e79c888b4b81539dc36e7184efc03d391d8ed2c5262316043a1497fc59bed61f3ee17e84182cb78ba0d0c01e763d5714750fbb3cb41fa4b5454378277c52bce029ffe97705605a73ba816898be37622b108637b3f8e6ffff3e961f08e5098716b11b865fff10afcf5e1aed49a13db5747cf53a76b1d901ffcd9df764c69a494709aa7ebf409a1cc0aad1d50806887731e5beeb8507ab52e7fc7bdbc69dba08f82a4490cd8ba4ff93f3f63a35312", @ANYPTR64, @ANYPTR64, @ANYPTR64, @ANYRESOCT=0x0], @ANYRESDEC=r0, @ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYRESDEC=r1, @ANYRES64=r0, @ANYPTR64, @ANYRESOCT=r0, @ANYRES32, @ANYPTR, @ANYRESHEX=r1], @ANYRES64=r0, @ANYBLOB="511e2eba776f0414253d767038ad420661f6e134374d98ce3703ee2a054efb8d0ca0578fc734a1e314be6e242809cd45b91b55d2972522c3fdc434b77a04ed962397a68e4801304e69a1b9fc3ecf8556755197a438a1c97602895c7bfe392d33f7bf316bbaca4c378d51b85b6377f4ae59cd5a5cbb7606e0056b878bdbc0f72d96a1c10da8ec80d4c3e4a91a9286bde6ebbc9615ac86513452774fe1e16afc3a46e837da757f93cb31f27fb8fe629ba7bbae1d0424f412327bad65debf408c7a17e6cdbd14dfcadd9eec802c3242"], @ANYRES64=r1, @ANYRES64=r1, @ANYRES32=r1], 0x2ad, 0x0, &(0x7f0000000240)}) [ 3409.141842][ T5837] binder: 5836:5837 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="180000000301ff100500dc1b411bc5a43458671ce2d3b53f66cad80f4bdb1707190061e8f8595165809d4ffc72ccbd52b2d269c7f39951bc03d687707e81362ffb27d85806862d0cca8d8d42202d63c62d8474af50e756b1bc9b131800b932c9571dc7b23d328b037696dd3b82fd58dccecb9c09813b47398b71b92caab320c2068c9b4fe1123b8c1fd65174b07643faa746767448b3a8cad2375a6cc8927aafb23f000000dc8f2da1c99a460b40dea020ece789be06f4659e0fd5ee4a687c5bc510bde0"], 0x14}}, 0x0) syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) [ 3409.273744][ T6149] binder: 6116:6149 unknown command 3 [ 3409.292804][ T6149] binder: 6116:6149 ioctl c0306201 20000040 returned -22 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7a}) 06:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x5865}, 0x0) [ 3409.383012][ T8091] binder: undelivered TRANSACTION_ERROR: 29201 06:14:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10010, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7, 0x40000) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x1ff) 06:14:52 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000200)=0xe8) r2 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000300)='tasks\x00', 0x2, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x5000000}, 0xc, &(0x7f0000000340)={&(0x7f00000005c0)={0x1420, 0xa, 0xa, 0x401, 0x70bd26, 0x25dfdbfb, {0x2, 0x0, 0xa}, [@nested={0x109c, 0x57, [@generic="8f1ad918e184b256717b87bffbfc8f8c301d893e5887362221ebd55292c365ff6ae30252813bbe17d81b3be238150007e0760c34cd6239ee43dcf3e5b987997e7528db34bfc5f53ec7f9e0943a178bbfc8e87dc9414d2cdf30bede9b1fdcae00b8d50b50403a52c928e5e43cf4706d216b95756096fff34f7ee466aea554214f345db461176745006acd7a17ed99ca5928671c7abf12043a5bd4d7eb9da45fc2f6fb0ff23d39b32d7e54b5e2c24a51a49ea3aaa3f471ecf0ad4ee2b136b1e29a19fa411283fcf9c3a467005bb1dc509877e1154b759d1c34252f46300933db6b668e78a060c73c84ed9da99a3362b59acea0ec8e6421ab13cb2f4134ef74eb3c1124d4ea1ab784b1f0a82249b7f8d29cca10b72914545070a8234df187ee95e04934f410aee5c9565084b103d70672b5e7c094beee9453bfd10ae467505059c757071283cbaa9dbceb9bb9c2b055951bbabd6166a679f2a0f1e7bbe620d5666cd2e3744cf08be25e9673deb5ec948c2543b27c52c6b511e39fa6796a555c39009c1a48b522a27877deab862f48ec5f622dd47ea049a1264bf4d06c8984a0e333d6832d2d389f651a109be76cd920a5011d350068f5557305138920881cb3b2b5e15abce81d44e892babbb7570d31f65453bfb5ce43363210b2458398562db6373bab62e1a5487121723eaec767382f0243be94fecd6d91ca913ce8b7e1156ef36d318f62ee41f7c5253386688e8d81c17e67f81a1d03ba388c3eb0ce6c2a74b18af955718dcbe34a71d9a019df0ff0b0a452231b4be9a76df89f4c2c9a8f7b350e990a744d3bbb4ea79ddc7580d82317d169127e2c64930cced36ab93bfbba243593d543ea58cf631b79a7b7e3af62978a5b22cdd326ae034a6cc570785293f7084505fd8d84cde9fedb89b17f55631a77a94f15175c91bb53d2903fb7e26bd58b08083e663edfed45d564a7a00f60ac1b534d6f7a647f95d8ef36074988215ed7298641a2481f9bebf8c615f88ad41d4a56bb53e81093667721695dac2f812ab20820cd3689379ddd2c5d70322186de9f582521f3aa83ccf649294c6bc7fb25fd53b1d238819a0f1e471fab0133ba0d9617d483d3db32a41308e4bd1a70279bbcbf7a7c1616c75e9f8d9a61aabdc3eb929f45cb0eaa00087ab70aaa4dba7a573f1df383e2886e950ba239808e4f2949d6fa286e95f94f867de8d1cbea6b15343ba5532d35b01583b4f01c21b10d978535edbdea973bc97887696a2ea6798faccc7e6cd0b29d7cfe87fb6f9c76eb077bb89d04f391e1449ef4e243d902d91dba21892c1abfb5197c570d9541944cfd2592ed6fafb759dfd0d501bc857d077c329090a03dfa5cc31608b7a4239bd6ad6410537b4cf6b42bbf4264621b71318b7038920cdef660877211fd50b24a0c91aefe30a96a6e5cd42c6e4ab6e21116555d62cc855ec159c49367ddb6036c11c9195bfebba628ab86ad993fcf3c5eb4e89c675300f2c8bc6ded60cb60f2ee10c57b5a718ebeb3492679a42225f18e60f4fe96f581ea147fcb7246287e72e37cbcbe15d31cc1f0735300d2f3591b96fc42967b655d17b08dbf75b9045060596b2d939b34c07030efe8a2c265be894b25be227e8b5f4ab67a863a522783493e962a34ffef99b8ba5a0a749dd328092cf2211614c212512f4d2feb3bd058c3b225f1ee243307587f52c1e750c1c6d03d4e7133b96830590787bcfa497cb89f34e09e078eb25d7463a95f0e82ce281d762fceb6aa165009d1c39d299acb15e170d54c021988a7233a871bdb45a23c0894b5e11db7076e0fa94e4a1a01d3f157f271c270b0af3bffc341ee9d839ee4ff8b8d6fa043e13f5eee474772a55f54c8c633d132f323a6e8025b22e40ec9290c21703a77837b3fc547eae604a502935812153f9457bc177595974cc1bc6f75ea39dea1ba12c6a654428a837247f29e5a4e500ad9ae50e931f2e331d27e9ec16ad18106e95316b1d687f74e882f5cc669470e1151c2c3566df4b78300f25cd2d004b9ee6951f2727c4128ef1517d753b659553cf7113d31a84b7fd3add40d9c422ec75a2d9477603d0994d676d76de378ded5d3a6217653c895d1004464b4ab5e18c48c6b85fa831011e0a7e709f26b9e087daa8653ae0ae2ea1561920bdea518bb8e906d8b46a267d9540472e8dae4d05492da740a26b62668881f201bbd586e5e6ea3530151ec365c8757f75427c27fd639f280f3bf2d3612190789d6087bc6f951a30ac5ff019c488ace34e15f7c7318b31e39a72ce5ae221c16554e5ce4a46e6772a160dc1bd9ce592bb49f7272e1fb02f7fdb8ce6dce00c9381db1162efd0e36ed712cae42b1ed5fd0919ede90b07b96fc615be2d4641fae70f3aa554d54ca3c0da84643ae6bedc02aca2970cfb54dc078033d6db362f09428c20970f2eab39bebb85d6e54e2350af58db1256df5ae5b5af66154e8902cf23698db96f72f9e9cf7523180c109421b0b526be7feeaf543f88b5a1fb23e6a1c5545bb31fb97912a94be496500392f1a019d6264a1573dad7db4a0939f22b99a3b5434afab211fc6c694dd3a80beae2583689dd45d8c4efd7532065fc550dfbc95d9c57c4538aea4f09d9644c8fffab043a254ece9ec9b4653bd926d233c23646613d71e671128f9d0d641163c8ffc6d36182840b3d61631d823519cdcde1abdf7ae538372fe6f6aa23bdef82c5c16473bde7d05def430e069e095d397450d1044de5bc7eab220b60e7fdc9aa71c4e06b216f53ead606909d065645db943023a82e6399f5a0893ef7b8acae3c2f6ed730670b4a8cb403bbd759a08479f46c566dd732b73903f77b545ad0c122b6f877b7a66f4a1ff3e3eafeeb91688eeb6c1c61cfdaf3eb802a3e3ac4a7ecc9bf4665a326c1c0fe855ecce21a5fb7b0d4bb803c7d5aaffa6d01f97da112c01d0a8b6901113c2172789f7f36ce80a3002168faf69e71d48327651db68fb2c896fd73187a39fcc301b4eb6592a434ca026b3145c424e80fa04a57a2cb3df0435d4fc9027d74feebbefbca3036edbfdf73da5181b8d52d680ae1245ba85da743ed3386571b44bd61603483862eb96fa0c2f3e751dd111e6f8ccd846d4ea2edf976fe0cfdb45263dd73b02663fefb6acc248c938655b0172d9e31cc8dcab31417f37879d2eee2158ac81560b8bec335837b1c2bf2691b786e2a5da76282fa1484af88da696f77b52bc230bd57316a08fe0764a1df86e25bb42f6c97a4c5734fdc5f4db76eb90466e7ff305c31ce7e9b8312f8b888f1c3bdc0ef99cf0d8867f14505e4255ae9079fa18f5552c798d3b661491fd9bed29eca9b947c526ef469e68cb3a45319b02d5cf1b3328b94a66c31bdfc8daf386cc5fd1c7c7ad784a1874a94cda56ce15f9a5b221514152f8e05472a3578e97cc7c0bfe99dd0f826a974b157db6ebcb9c842a26340dfd0fbbec8b393a8fb2f4fb4b79c81b4eb2ec280081dac30b29eeb8bf25fed0e4681e99927d9c03d4934436ef1c44a5e863fc371530cce95245366f7e844125b0f94da1fffccd1e5e514494dc42a5caabf0c1adc7cb2c8593c80afa040ebd65d7d6bae008c574df8f069eea7453433c6f43c1e3f3f33b37fcc551d00e646469a260d34ab1bc92b608f715f8d1c9e5c98787f43ea7b1cd7a271cff8e00d0e4a84e345a65728ec6b49624a93221bcec8a576c0b7127994e9183197815531e8ea8f7857514a85c275781fc0b4e98b113871dd60c6594e58fb7d32f3425f2e86eba1cb47b9af014f0b798935a96eaa3a459f170d92c0a0c55434b0e1fa8df3e232622d502ef52a27c1893459a3484a17358aa5ed878b71915a911c039989a17a9e46a050b176c4c220176208530073f2002765f94d27996b2710065bb1b85ddd833618c676b1212280a8f6a60c4c15504f037f5b4d37b743aa156c3c2f8e0b358a813e353ac44c1d75bc309e5db0beb06893d1eaaa50fe85ce4bf5fe1e310b22a7e3fd683b199a0b68300352badd2813d47856a3c7e7bf33cca3ea625041a2a76661f9213e072ffe97f3de742904686b38a82c55d8a07bbd9be423dbaa1ae737910952ce02112b77ac5dca112e73b0f60847271d2cd49a6211b32f8e79b950730078ce0f2f34f4c16bf425bbe5061cff667560d8c021905644efaee41eb10e5bb9aaf1eea66687020e740e7fb489588f76aeb49c4488ebb6db75dc5e19c0a53bda68163a83f3bd2f8dd83054606f76bdf7092e350238c1699fd5845367ed5ba617144c8577526ec390900973138278377b642e4f6ffb62890def55a06e5eee78911ee47b0a05eb5afc9544bbf0e72a9cfa75bff0c532e1e84e384b2c2a50109bcebf15cb83c22abec31780495d100555813e23c0d98e2668908c837a5a93114a7ee41d30b3c7b49119a1b833a0246bff52157e040daab9e857d4748e1479f03ec8b603da5664f7c9a69c5e0282ff4f1b0e9545710d3154dee778b2e71214b9f7802e545bb8389dc5d2a1248f1b9657bd0b88e811f99a51cc73edc42eabf214577459cb173ff90e0b9fb72a42163a7fc6f1207ba8f1200b602a401b9fc4f662331eef0615d6da5b612efb369147a4e1edbdb7d8dc93d24cb89cc0cb82a39ee6525fc250e7d41387cce3190b2db21227a1453e21df561817c2f85171f4011764aa9998b45d348a133402424908f8b8761403370c6bf68b9745ec0898de359251b8d39ad6717799f5020fb040ae2cae5210c324b862e31d3d41dec9634201aafd989b99f4aa720ab0b70197229fb66ff3604dee3f5a687b0b6ea675ede7c1bb59e680805ab8c849c83fa48862d23ed33a68d29a90ae2b44fac615ac8a6c439e11e6ff0bfd709aa74cbd0efadb6dc44a289e7fd6c21c43776c6a69bd1384c0be3dbe2ef4aa26191998f9c05261ed33045d5cffa0bf93b7bba6a9ffb382c45cfd6210c053fe7dca1c97b7cdf4513a1385fc6a8a360c32ea713c6d244e79b05aa817f2567bb6f81188a3b8acc28cb098b09e5cd7c0ab11097469ccac81fd19deb06de14c371cd845dd2a263706c1368d5996eb595e34f8e62030fea9eea062d99de4407c2971806fb3ab252e2c6d093dbc5048c201cfd8ba38f384d78413a89b885469350faa2fb551d0cde1d83c76c479e268fcc9d96495e483cea6673790eea4e8848f3269495053c5f7f3eb31deceec48446c40811ffbaa320677efa49d225f7ef917f86614705603bddda5f5e78c48e3932522ccc6feb11fdd3992652600d58497728d0785e3f808861c21f0b3a92cbd8fd3ad08b7c0d2f1f0ce34d0766723431602f37b15f8bf755d364db605b39c1870a615d50bbf1eeb8f2070db734edd8d7c98de81c46b88470f1e48dd9546a255238b4e8da092635527a660f128a2ad1802b6a2d7db1a177ff973c6d413445e875f11c7d01df8514d447652a6963cef9ca5da6f741bd331815ff9e07fe807cb7b91f844f60562ac6c47e5e9af00a8241ea01b12e9a3fc3205d6ade2b1c5bab339999766ef0047dd14c92f53cc3d8e39248c01a1171dfeb9188600ef70304954b8fbcb8b9e6fc4f799b2009cc9777120952bdf32b1f8b9e0bc31c6b89dd13b7470321dc05b5921ada7d27730e8079279d18f3d19cd4ec1bf6811746c222b85f445c285b1d77ff0ef56bf0c0a09b27ef3133e102e55d0f18912967931171f49918c15b0a3a1a66ae3759b09c0ba0993d583178c93866fa2fbcbfa79fbee9fbd677bfd536afad54bd7e2a0cc21dd9e53846074183564a6ca3b5d257a085e243d000a07a366369f96b0b17", @typed={0x8, 0x1, @u32=0x5}, @generic, @generic="78cba2c295a16ebe6925e8d1faea5ae7390ca802fcdd21dbf4d079e0655190a72aa37c13670e670b633e31855fea268ab0c808618a475c0b43f24dd62035bdfe09a499725248dea36aa0d3e2fb7c274b15259de3da535153d1c0e13702cb7de6da60723c179672daf0b6c31ad7593c5da5129598fedb541c7f010ab026b89aab3b7bc7174d2de49168e6333458"]}, @nested={0x1a4, 0x39, [@typed={0x4, 0x93}, @generic="e914e418b339f8a862dce397eb88aa40e26b811fc7e915330ffa836428778a83a595a8520b2d9059cef11ff75320efe7a6ae0decd545e0ec2bce576cb0114441120ed3589cc2c2b5a5a7eb55770260cfb2e8c3f4f1c0df7bd730c4ecd2937156d881be4b9160f398c145acb97a9a5f2f56dab0dd6c42ebcfe7c08d77ce5434910ab6fef7af32e0b8a0bab5ce4d949379948914dfa985f72793cbe50ef1d77c64da0c237762ab679ae7686c73923dafeed5e428d3ebf8fa1a2f4a95a2559df9d8a1b427eaa8fb812a18d7e4e3b3271847a0743079e4784237677a01bec8329851c20c847edcfdb9aed76f145f5a600d47f60347d1c4bdb9", @typed={0x8, 0x92, @uid=r1}, @typed={0x9c, 0x8e, @binary="fe9bf9441189428f73aa02406b5c1f7982c3498d44d71cf0aa7e3bb0484a051dae1ce24036a08dc7f5479ee4f246276f1eece9c52a55c6169c856d385d6b09cc4e722c4a707b8677ca0244030b3a8f3f7cee0851089257ab418330396f95de042e6d5c974eaeecc1a5c5bdd596b7e85522a2ad8189803e82fd85ceed0fcaddfd827febc180c79146dcf075e652ad6734afcc78f35ff513"}]}, @nested={0x1cc, 0x3d, [@generic="543bf2979f32bed4cd722e0750fa8c2855bc53f84ac28e23aadfa6b5d9cf9fcce830836248108fa395b55a5b9f12bab7b77c0887b1a23eb1b296d72acd41e40404052aa841ace8f815c9172405c154765ad7ac92b62ab00c5cd9cdba5b7db3b30944d58899b943c60647a2aec2b1dfbcc4be578bf82f25fcc505acb71c2a75cf97edfdb267c800983bb999ea8b58ebd97f1a51e1bb16dcdc5b0c87d126e26e8c32aaad870e177940d68beb155c417e80750adcf379cf87b0d03791881b98aad68476a294a41f211544ecf103b33d847a7d442e56d70117a8c6bcadbe656f372f272a", @typed={0x8, 0x81, @fd=r2}, @generic="5c134e9aa87f453b8589ad3cb4bf1f86ec6d4d3fba60bacf7151808c53b1339db51b2e0a029ebb310b05d38bc67fac7b5fb62bd91eb2eb06771b000cd77174d519555d5c5555480b0c0acd27bc8fc11ad86214d5b9e51fed81ffe5fb8fab477c46a0cc22468c76b89ebfd7d526e55a6dcac110e9b5df34e42ca62a53fbda155f6fc6c72ff5de45ed6a2632f309d344e9dd1142728bcc3ac9483f18e4a8978490c4fe45c4af45aee69ac78d01121ebdb146c3cfc35877b18f21cc6aab14879135fee2cb7b439cbe38", @generic="767635d28a67", @typed={0x8, 0x51, @ipv4=@dev={0xac, 0x14, 0x14, 0x19}}, @typed={0x8, 0x13, @str='&#\x00'}]}]}, 0x1420}, 0x1, 0x0, 0x0, 0x800}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:14:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair(0x11, 0x80007, 0x80, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000140)={0x1, 0x0, 0x3, 0x7}, 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) ftruncate(r0, 0xfba) [ 3409.481609][ T6537] binder_alloc: 6536: binder_alloc_buf, no vma 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xbf}) [ 3409.546375][ T6564] binder: 6555:6564 got transaction with invalid offset (0, min 0 max 0) or object. [ 3409.590285][ T6543] binder: 6542:6543 got transaction with invalid offsets ptr 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfd}) 06:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x58af}, 0x0) 06:14:52 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="006340400000000000000000000000000000f87100000000000000000200000000000000000000000000000000300000000000000a00848402efe3693bf98dfd312a4c378f6b8a58151c7e3484f92ee355c525868e27387899fdc1091cf5c281f576ed927855c5564dcee60c11e39e6f77daaf7e95741d407dcd6f6317764453a3bcc4899df63f482920c71d0ed29b401b21aa3ce52f467b82863579670adf90b63812e01edb37809df837607e8afd094f33cfe7088d8f13e63bcf0d9c02150081520debe6149e8a229266701e4c4d453a0c082fdf205cbbe0d3394701dff490f0c3c1061cc7e9ab06ef34d5be7728151f00000000000000e9ef4f41b582185652856b74b3b8366b40d17aa840b7035a64adced7234dd075daeddae58ee7df2d50bdaff8248755a50d8ae0ff008665c263498a81d74980bc87809cb1299d7a3c8006d2f5b9380f3c7c5fd9d79279f6b44cc9bca285fcfb2d0880f8536c99f21e4d5b0d172b5b29ea897c6512a40569130383b759f0fcb7bbdcca6e38b27430b150583d639a1817743caaaf3d2b074eac6ee27518588ff52e0c608b969661bdcb59", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="0800000001000010"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000030, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:52 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x404800, 0x0) write$P9_RSYMLINK(r1, &(0x7f00000000c0)={0x14, 0x11, 0x1, {0x0, 0x3, 0x5}}, 0x14) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x300}) [ 3409.796972][ T7075] binder_alloc: 7068: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x6000}, 0x0) [ 3409.872454][ T7114] binder: 7105:7114 got transaction with invalid offsets ptr [ 3409.900523][ T7187] binder_alloc: 7068: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x500}) 06:14:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xe) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYBLOB="ba92b390a5916bb80359bb08a40000020305000040"]], 0x1fd, 0x0, &(0x7f0000000300)}) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x43, 0x0) 06:14:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x6558}, 0x0) [ 3410.091737][ T7440] binder_alloc: 7429: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x600}) 06:14:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x81, 0x8000) ioctl$RTC_AIE_ON(r2, 0x7001) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e22, @broadcast}}, [0x800000000, 0x8, 0x5, 0x9, 0x4, 0x100000001, 0x0, 0x0, 0x8, 0x200, 0x80000000, 0x5, 0x7, 0x6, 0x1f]}, &(0x7f0000000140)=0x100) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000300)={r3, @in6={{0xa, 0x4e20, 0x1, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x19}}}}, 0x7, 0x4}, 0x88) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000180)={r3, 0xe64, 0x10000}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:52 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@mcast2, @in6=@initdev}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000000040)=0xe8) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/ipx\x00') ioctl$VIDIOC_QUERY_EXT_CTRL(r1, 0xc0e85667, &(0x7f0000000300)={0x80000000, 0x0, "7af31df7a9f34bbd5d2726715279176e5f3c32bccdabb6d2463940f103fb332f", 0x46b, 0x6e, 0x0, 0x2, 0x5, 0x0, 0x10c, 0x101, [0x3, 0x5f4, 0x0, 0x8]}) ioctl$VIDIOC_DBG_G_CHIP_INFO(r1, 0xc0c85666, &(0x7f0000000200)={{0x2, @addr=0x1}, "abe046b97fa5067a84e896392a8f7f6874ad0e59e1f1acd60a17048b2e07b4c5", 0x1}) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000300001018dd00000000000000000000"], 0x14}}, 0x0) 06:14:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x700}) 06:14:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000048, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3410.281435][ T7895] binder: BINDER_SET_CONTEXT_MGR already set 06:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x8100}, 0x0) 06:14:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r2 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000000), &(0x7f0000000240)=0x4) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000000180)={@mcast2}, &(0x7f0000000200)=0x14) syz_open_dev$ndb(&(0x7f0000000280)='/dev/nbd#\x00', 0x0, 0x103000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000380)=ANY=[@ANYBLOB="000000000000007395da"]], 0x1fd, 0x0, &(0x7f0000000300)}) futex(&(0x7f00000002c0)=0x2, 0x8c, 0x0, &(0x7f0000000300), &(0x7f0000000340)=0x2, 0x2) [ 3410.334332][ T7895] binder: 7852:7895 ioctl 40046207 0 returned -16 06:14:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xa00}) [ 3410.421764][ T8041] binder_alloc: 8028: binder_alloc_buf, no vma 06:14:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="160500000018dd00c2506de8e8e9ec6c3f07533a22ce2431e6004d041b9a596c0f6d27b903084ad287bbb15e88a46c483d83de71f421213f80217a"], 0x14}}, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000040)) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x1, 0x0) getsockname$inet(r1, &(0x7f0000000100)={0x2, 0x0, @initdev}, &(0x7f0000000140)=0x10) 06:14:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2100}) 06:14:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000000a606000000000000000000000000000029608ab4cfde000000000000000000000000000000e440e433", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3410.464036][ T7996] binder_alloc: 8028: binder_alloc_buf, no vma 06:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xaf58}, 0x0) [ 3410.569626][ T8438] binder: BINDER_SET_CONTEXT_MGR already set [ 3410.595699][ T8438] binder: 8432:8438 ioctl 40046207 0 returned -16 06:14:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)="71e67a111fde54fe46b904832c8fff73", 0x10) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000003b80)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}, 0x0) recvmsg$kcm(r2, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000007f80)=[{&(0x7f0000006f80)=""/4096, 0x1000}], 0x1}, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x10880, 0xb5) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000280)={'tunl0\x00', 0x600}) sendfile64(r0, r2, 0x0, 0x80000001) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0xfffffffffffffffb, 0x0, &(0x7f0000000140)}) accept4(r2, &(0x7f0000000140)=@hci, &(0x7f0000000200)=0x80, 0x800) 06:14:53 executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88fd84487fec1ec000001018dd9eaf0491d732e678733564158ba0da4bfd4bc093e919ef80c176fbe6fe47795e71dc29fd42a5828aebb773e06a44ffd6498f8f03d4b24e4c56d42706803538cbbe145068465762f8d948bced42361264f0644b96389ccacc04fe2414ea5ccc306031bb11e2533623d5d1bb65224c17a431e80f1e52b2c35d6e535f73788d691d709857d0af953a74989fa724ec488f7b1a41e65e887234830051e3df8d995268ff5c7e8d1b"], 0xbf}}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x2000, 0x0) ioctl$sock_ifreq(r0, 0x8994, &(0x7f00000001c0)={'bond0\x00', @ifru_flags=0x8200}) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f00000000c0)) 06:14:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4200}) 06:14:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x20000000000004c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3410.757426][ T8739] binder: 8698:8739 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) uselib(&(0x7f0000000000)='./file0\x00') ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f0000000180)=[@in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}], 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e20, 0x401, @mcast1, 0x7}, @in6={0xa, 0x4e23, 0xb575, @rand_addr="0031ba4e39a5f3a6b44f0d3fb04ebf75", 0xfffffffffffff000}, @in={0x2, 0x4e20, @empty}, @in={0x2, 0x0, @multicast2}, @in6={0xa, 0x4e23, 0x81, @remote, 0x3}, @in6={0xa, 0x4e21, 0x9, @mcast1, 0x5}, @in={0x2, 0x4e20, @multicast1}], 0xb0) 06:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xdefe}, 0x0) 06:14:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4800}) 06:14:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB="00000000dd50853d79859dcc5c0885112bbca4178b2f6132612078da269d571d02beec00badd9b5a81ab4b1074505cd26fd4900f9728ea38d040a34aec4ba941983c2cf36ae009dd2d2ac84cc9d8e1a68587b09f76b79ade9b599c76b411a96cb5a2144f922ea81db28d86cffd6dcde228ed08d819225d2db258061897c84fb83b9b22dca8e951b719a00000000094f108fef3000000000000ff1199f38638b108be0cd1d3135b4143f1dbc054101e0fce785c677f7e60db43d42e7a8893492c4aa24fa9201bb60426086d349997de932d204dde325510a9cad7e0413d55838e27266e4f8dc26ab67ef0ffbce1dd92953ae3aa4bccf61157e0"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3410.922161][ T8972] binder_alloc: 8698: binder_alloc_buf failed to map pages in userspace, no vma [ 3410.952198][ T9012] binder: BINDER_SET_CONTEXT_MGR already set [ 3410.986934][ T9012] binder: 8957:9012 ioctl 40046207 0 returned -16 06:14:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[]}}, 0x0) 06:14:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4c00}) 06:14:53 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf000}, 0x0) [ 3411.057808][ T9186] binder_alloc: 9163: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:53 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="142436195eacb43f36cb999956870000011e01ff07008fb4a35288c000001018dd"], 0x14}}, 0x0) syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x20000000000000, 0x492882) 06:14:53 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x420000, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0, 0x1f}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={r1, 0x4}, &(0x7f0000000240)=0x8) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6800}) 06:14:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000060, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x9, 0x60011, r0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x1, 0x2) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e20, 0x8, @local, 0xfffffffffffffffc}}, 0x18, 0x9, 0x3, 0x7, 0xbf2}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000480)={r3}, &(0x7f00000004c0)=0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x80, 0x81}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000280)={r5, 0xfffffffffffffff8, 0x8}, &(0x7f00000002c0)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r6 = fcntl$dupfd(r1, 0x0, r0) write$P9_RSTAT(r6, &(0x7f0000000300)={0x9e, 0x7d, 0x2, {0x0, 0x97, 0x2, 0x1f, {0xa1, 0xf09e, 0x2}, 0x2050000, 0xfffffffffffffff7, 0xff, 0x5, 0x17, 'cpusetmime_type^cpuset.', 0x33, '\x94\xb7\xaf\x9e?\xca&1der#\x00\xf2v\x9a\x83yv1k\x05[\xa9\xde\x8f\xb5m\xe6\xa2\xd4\xb2+N\xe7\xbe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xd, '/dev/binder#\x00', 0xd, '/dev/binder#\x00'}}, 0x9e) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f0000000500)=0x9) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000540)=0x1) msgget$private(0x0, 0x14) sched_yield() [ 3411.358194][ T9522] binder_alloc: 9520: binder_alloc_buf, no vma [ 3411.367966][ T9523] binder: BINDER_SET_CONTEXT_MGR already set [ 3411.376744][ T9523] binder: 9516:9523 ioctl 40046207 0 returned -16 [ 3411.384782][ T9526] binder_alloc: 9520: binder_alloc_buf, no vma [ 3411.391666][ T9522] binder_transaction: 21 callbacks suppressed [ 3411.391687][ T9522] binder: 9520:9522 transaction failed 29189/-3, size 0-12288 line 3147 06:14:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6c00}) [ 3411.406909][ T9526] binder: 9524:9526 transaction failed 29189/-3, size 0-12288 line 3147 06:14:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x10040) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000140)={0x0, 0x18, "aed83090356d54bbcfb103b07ebd46cab390c2007a0af0e6"}, &(0x7f0000000180)=0x20) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000200)={r3, 0x3f}, 0x8) 06:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xfede}, 0x0) 06:14:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x40000, 0x0) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x0, 0x1f, 0x1, 0x9, 0x0, 0x9, 0x80000, 0x4, 0x8, 0x4bb3, 0x5, 0x8000000000, 0x603, 0x3ff, 0x5, 0x3, 0x10000, 0x401, 0x7, 0x5, 0x4, 0x8, 0xa9, 0x200, 0x5, 0x401, 0xbe2c, 0x7, 0x3, 0x2, 0x6c6, 0x1000, 0x2, 0x1f, 0x1, 0x8, 0x0, 0x9, 0x2, @perf_config_ext={0x1, 0x1000}, 0x40, 0xffffffffffffff7e, 0x8001, 0x5, 0x100000001, 0xfffffffffffffff7, 0x6}, r1, 0x1, r2, 0xb) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd2de92c9e776b5b2facaafe251223dde0c3e517b999a51d6118f5c0ddee7bf268f5c8d55470c846c60d0980425422d7da3b"], 0x14}}, 0x0) 06:14:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7400}) 06:14:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) read(r1, &(0x7f0000000200)=""/189, 0xbd) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x1, 0x0) ioctl$KDENABIO(r2, 0x4b36) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3411.604828][ T9992] binder: 9985:9992 got transaction with invalid offsets ptr [ 3411.658378][ T9992] binder: 9985:9992 transaction failed 29201/-14, size 0-12288 line 3193 [ 3411.670643][T10020] binder: BINDER_SET_CONTEXT_MGR already set [ 3411.692744][T10020] binder: 10002:10020 ioctl 40046207 0 returned -16 06:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x34000}, 0x0) 06:14:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7a00}) 06:14:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000068, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_netfilter(r0, &(0x7f0000000680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40002000}, 0xc, &(0x7f0000000640)={&(0x7f00000001c0)={0x444, 0x1, 0xf, 0x70d, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x5}, [@typed={0x4, 0x9}, @generic="41cf73e83392bddbc90bb3c6eaebfe935cfac0e6ea8a330350cfe134973b83a6c837f35d6261d11a7f7b12e3b4e15665bc324b4879d1db610e81f4b758d9a2e2a7afeff71fff7325f3c7ff9ba941b8901e7217503791b13a59427bbc417ed09d93eb2861da7001b4da0f3b6feaa633b57f8ec4be3eb2aefdf1046dee1c80fb894b8f879944cc05f81853990ab537606e2f43c7ba831cbb7d4e42e72df061d8216e426bed13ef95e99d7ce4efaebfe2861dd6e80d2e471c4a7206e2c17bed9b139667a289c49c08b086504b021330ee7aaa0f3872077a07ce90ea1925d1bd8ed730a64b18967eddc589b9e847ba72d9f8e2111cc4c0eaf0071cd27aecf2f8", @generic="2733455ebc99a2fb9b20fa667ec8e2c237b6611ca3d5d13f3458152fee8aca324742063fd82a89c90a84258826d18eedb62e337914d476329eafbfbe3a87409ddada0c033468e3c6b82d0e599928f6f2801a4fc44ae08c5f3b99b90ea607a52d7a943214b076d1f4d4a48c450f81ca54dde6e9159983a7a186a9bd189c222f352f6e3f125c91ee036a05811c05ad9a01", @nested={0x8, 0x1, [@typed={0x4, 0x21}]}, @typed={0x4, 0x35}, @nested={0x274, 0x4d, [@typed={0x8, 0x1f, @uid=r1}, @generic="03c3e6659190c5e22c9248d2e5fcba63d7884cc376b69d4c9f5b333985373ccb5cf88f93327ab807085f159a7af2733a150ba9f8c493fd5d24980485535aa62e0a23dbb5f18703bd5e3db5d809ddb23e07a4c68fd1479ce7f68484", @generic, @typed={0xc, 0x91, @u64=0x8144}, @generic="bf4f1428f6014987faf7d925a981772a", @generic="318a7d058381e09769c665694ee28225a997130184a50d39649fed617fbc48b4c7a0d6093cc8c9b64a02473a484be7b40323b4695e9f6e02de618178e711edbda06ff8225d5bbfe8554af0ae09b6b913bef109d7daba862b6d8c", @typed={0x4, 0x65}, @generic="62a2fce14ae6792e3f655e2be7517bc0a7a38f3a3bc3ed6c5203daab0177e39c07b26b8aa8187b36487f32542cfd2a920c697ef404e034cd4b9511a6a57e37490b7f281c1735ebf80dd47c010f4a232239f1140f05033fe514f22066f10ed094e777bda20d54086050e5c68388c27679ab4097a0d887001c564193097638e145479644fbe584972530839508689075b5ccfbb05730fb71ee", @generic="fc694dddc7d6e761a556ccaa776b024ac35aa07cc785f1b75365deef2931722fd76babe2f3a058e7d17dd124fb92629957a400307bb45d1f5de6a1d373279826af9fb93c8e7c1c79d084589c067bf783b5dad664407354974573f98bc3e680c22b59e721523b483155a80b7f74cc8650bdaba8fea4adfb26a383d0903747db878d6017c0bbd204357d3ea5c96f8958b174acb8619ae2f67d9594e449f503e3cf4c5c025d536585461760ce1583ef04cc3f38db07694438ef005bd689a923823c3fb811b31403763ad48e833ac2c336a808c2f4d1b7fa7908838539e7503236e180e65f4bc23d22f734ec77e23355db79d0d5d23070d87a10"]}, @nested={0x1c, 0x61, [@typed={0x4, 0x5a}, @typed={0xc, 0x95, @u64}, @typed={0x8, 0x30, @str='#\x00'}]}]}, 0x444}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="00000301ff5205007fa52c52bf7f9a4132f98d3400000000000000101881"], 0x14}}, 0x0) pipe2(&(0x7f00000006c0)={0xffffffffffffffff}, 0x800) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r2, 0x800443d2, &(0x7f00000007c0)={0x8, &(0x7f0000000700)=[{}, {}, {}, {}, {}, {}, {}, {}]}) 06:14:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x10001, 0x4802) ioctl$VIDIOC_S_FBUF(r2, 0x402c560b, &(0x7f0000000140)={0x25, 0x0, &(0x7f0000000200)="f0908641925972b696391eda52146683a640e16de078c6a8678ddbfda5a36697652da1a898c08e0e326f601aea1743f7eab97068ac289e03b9c727a0347552d085858d1a07cc331e48f5c4d4a5f8cf39c0202a64c99e9e91666ba9fd3fb0f81fb0bac873ef7e96cdee43e0ae1ed2f79e4c06c5a87730f3cdb705af88022c25cabd56aad6ea7b3c9d3a4d2e5404ab769ccff581f402753405ced7af8ca271740498f35e88f2e24adf3c8fc876000f9d0530132cc46790399a086ac8fa9b03f5fed928c11bd5eabcf49040283edef23859d8f6e843dc480aaeaa6257f2c44ecb8b79154b7490c703f74403d5c16c3f07c01d6ce266b968", {0x9, 0x3, 0x33363248, 0x8, 0x0, 0x0, 0xf, 0x5}}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000004c0)=ANY=[@ANYBLOB="757365722e2fc5a94e603c979c3d65722300879f90c1752d9e122b3906e5a2be3bdab16c5276909c366f56c0346844d192788451596565409e92833552dce6ff55070a886a05b1b71e1c8b1be7b0783b3f3b6912f3427e14cd8d4fbe02b77bc75209a9d8ae1e8315af45986d66dfe6cf73a097d5530a0c6070d69f227639a49b6c3577543cfea5031465aa9cc4064a457de9"], &(0x7f0000000400)=""/173, 0xad) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="006340400000000000000000321adbe5396c10c90000000000000000000000000000000000000000000000000030000000000000254366d421967f0d76395ec7eb0eaebe8736058ab611d99cd415320b2f2003df7669c4f7da801ff93684f6316edf833b59f1e265c8c38a2cfeb694bab456d248ce67bdb31ea7ff01c60aa9a151eda1e9620a0c09e64dac115f585ab9fad6726e02bd4c363aabafe4ec312dfb6939d52b548596e60bb7036851ebe8b0e19e446aea15be5d9e06e59315ff606627cf27db5a77e8a6eb369323c7f969d01bdf32a4d8621defa2312f9b5ce1878bd1e0a9d9af413c93849124ce2ec8938173cd92143838ae2bd049466a1fac6454e13d7e1456aa6cc455e0ecd20537ee82a25e16c7184c0bb9d55f9ecc72032ded4bbc46dcfc414408294e243e895de16b2cf7a76250709ec3c63acd38e459367401eed18d39055feaeff74353d7500cad4d5e762732ea206bddc5cae633a154e21756df6f26224d11112a455bf6f5ef1df39d20b0f085b5d1179f59e41e57035d11ee15af16bff95b", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3411.949823][T10570] binder_alloc: 10526: binder_alloc_buf failed to map page at 20002000 in userspace [ 3411.965533][T10552] binder: BINDER_SET_CONTEXT_MGR already set [ 3411.973096][T10523] binder_alloc: 10526: binder_alloc_buf failed to map page at 20002000 in userspace [ 3411.982877][T10570] binder: 10526:10570 transaction failed 29201/-12, size 0-12288 line 3147 06:14:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xbf00}) 06:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x400300}, 0x0) [ 3411.996248][T10552] binder: 10550:10552 ioctl 40046207 0 returned -16 [ 3412.009090][T10523] binder: 10458:10523 transaction failed 29201/-12, size 0-12288 line 3147 [ 3412.009294][T10552] binder_alloc: 10526: binder_alloc_buf failed to map page at 20002000 in userspace [ 3412.034472][T10552] binder: 10550:10552 transaction failed 29201/-12, size 0-12288 line 3147 06:14:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000070201cd8fbda3"], 0x14}}, 0x0) 06:14:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x2400, 0x0) ioctl$CAPI_GET_SERIAL(r2, 0xc0044308, &(0x7f0000000140)=0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:54 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfd00}) 06:14:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="000019ed0032c0f5"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018ddcb4649a00f83fcf8f67effba3c963d9ac0f2e347ef94af29c63739eed6b6dd66efe18fa8ccbfc2d5ed36c827cb484006be9c676b509c0a3b879ebc24af8a0f3cd97c28f50ee9397cf247558b52e35b9757f374690b401939e7d405c80e81ae249133d25b7239b075987cf08cc59de1aa7fa591d9696503b19b016f2fd0658a0e7e11f1572bbb16fb1521442ec967821e4f0c1c3cf001962831ede6f0813bac8553669fd510c2a094b1f439a86793f6ccadfb0858303a6a7bba6c165a4517f768c077dbf083eef710db3a77b9b5c16d"], 0x14}}, 0x0) [ 3412.202544][T11013] binder_alloc: 11012: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) [ 3412.266564][T11013] binder: 11012:11013 transaction failed 29201/-12, size 0-12288 line 3147 [ 3412.280673][T11062] binder: BINDER_SET_CONTEXT_MGR already set [ 3412.287275][T11062] binder: 11048:11062 ioctl 40046207 0 returned -16 [ 3412.300295][T11062] binder_alloc: 11012: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x20000000000006c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3412.345365][T11062] binder: 11048:11062 transaction failed 29201/-12, size 0-12288 line 3147 06:14:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1000000}) 06:14:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20ncci\x00', 0x20902, 0x0) bind$can_raw(r2, &(0x7f0000000240), 0x10) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$RTC_WIE_OFF(r2, 0x7010) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x800) semget$private(0x0, 0x0, 0x8) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) getdents64(r2, &(0x7f0000000280)=""/115, 0x73) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000020000006000000769100000030000000001900000000000000000000000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="848884eacccd410bf92c05cfd1003bb96dbe07bf9a"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2000000}) 06:14:55 executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x8000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x3, 0x10}, &(0x7f0000000100)=0xc) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000040)={0x1, 0x4}, 0x2) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000140)={0x1, 0x209, 0x6, 0x401, r1}, 0x10) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4004240b, &(0x7f00000001c0)={0x4, 0x70, 0xffff, 0x9, 0x7fffffff, 0xffffffffffff8000, 0x0, 0x0, 0x4000, 0x2, 0x5, 0x3, 0x7, 0x3ff, 0x4, 0x1, 0x1, 0xbd40, 0x5, 0x6, 0x0, 0x20, 0x81, 0x80, 0xf6d, 0x5, 0x6, 0x8, 0x10001, 0x0, 0xdf, 0x81, 0x2, 0x4, 0x1, 0x0, 0x0, 0x80000000, 0x0, 0x1, 0x6, @perf_bp={&(0x7f0000000180), 0x5}, 0x8101, 0x1ff, 0x3, 0x2, 0x8, 0x20, 0x1}) [ 3412.475096][T11262] binder: 11251:11262 transaction failed 29189/-22, size 0-12288 line 2994 06:14:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req3={0x7, 0x80000000, 0x4, 0x7, 0x101, 0x9058000000, 0x2}, 0x1c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) 06:14:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3000000}) [ 3412.651044][T11508] binder: BINDER_SET_CONTEXT_MGR already set [ 3412.663995][T11508] binder: 11475:11508 ioctl 40046207 0 returned -16 06:14:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000240)=0x7f) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r3 = syz_open_dev$admmidi(0xfffffffffffffffe, 0x6, 0x40) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f0000000140)={&(0x7f0000000000)=[0xc0bc, 0xd0c, 0x3, 0x200, 0x7], 0x5, 0x2, 0x0, 0x81, 0x3, 0x4, {0x357d, 0xfffffffffffffff9, 0x50, 0xfffffffffffffffb, 0x3, 0x4, 0x9, 0x5, 0x2, 0xffffffffffffffe0, 0x7, 0x80000001, 0x2, 0x8, "49d52f481b748d716f78ccf5463157dc51946ec7a4f4d05c6162307df63e0c9c"}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f00000002c0)}) openat$vfio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vfio/vfio\x00', 0x10000, 0x0) 06:14:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getpeername(r0, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000040)=0xfffffffffffffe79) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3412.741854][T14121] binder: send failed reply for transaction 2254 to 11384:11389 [ 3412.753956][T14121] binder: undelivered TRANSACTION_ERROR: 29189 06:14:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4000000}) 06:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 06:14:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000074, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3412.910643][T11901] binder: 11882:11901 ioctl c06864a2 20000140 returned -22 06:14:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5000000}) 06:14:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x20000090839, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@initdev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000380)=0xe8) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x200000, 0x0) r5 = socket$inet(0x2, 0x2, 0x3) r6 = socket$bt_rfcomm(0x1f, 0x1, 0x3) r7 = socket$caif_seqpacket(0x25, 0x5, 0x2) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=@newtclass={0xf4, 0x28, 0x200, 0x70bd2b, 0x25dfdbfb, {0x0, r3, {0xb, 0xffe0}, {0xffff, 0xfff6}, {0xffff, 0x1f}}, [@tclass_kind_options=@c_drr={{0x8, 0x1, 'drr\x00'}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x1}}}, @tclass_kind_options=@c_atm={{0x8, 0x1, 'atm\x00'}, {0x74, 0x2, [@TCA_ATM_EXCESS={0x8, 0x4, {0xf, 0x1d}}, @TCA_ATM_EXCESS={0x8, 0x4, {0xf, 0xfff5}}, @TCA_ATM_EXCESS={0x8, 0x4, {0xd, 0xd}}, @TCA_ATM_HDR={0x28, 0x3, "11a3fe43068c5fb9ef0e1a36f4f36dc4299cd99dca73a2f215e1b759d4b112666868"}, @TCA_ATM_EXCESS={0x8, 0x4, {0xfffb, 0x9}}, @TCA_ATM_FD={0x8, 0x1, r4}, @TCA_ATM_EXCESS={0x8, 0x4, {0xffef, 0xfff7}}, @TCA_ATM_FD={0x8, 0x1, r5}, @TCA_ATM_FD={0x8, 0x1, r6}, @TCA_ATM_FD={0x8, 0x1, r1}]}}, @TCA_RATE={0x8, 0x5, {0x5, 0x3f}}, @tclass_kind_options=@c_atm={{0x8, 0x1, 'atm\x00'}, {0x1c, 0x2, [@TCA_ATM_EXCESS={0x8, 0x4, {0xfff3, 0xb}}, @TCA_ATM_FD={0x8, 0x1, r7}, @TCA_ATM_EXCESS={0x8, 0x4, {0xe, 0xfff3}}]}}, @tclass_kind_options=@c_drr={{0x8, 0x1, 'drr\x00'}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x4}}}]}, 0xf4}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3413.091847][T12212] binder_alloc: 11882: binder_alloc_buf failed to map pages in userspace, no vma 06:14:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) recvmsg$kcm(0xffffffffffffff9c, &(0x7f00000003c0)={&(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000300)=""/137, 0x89}, {&(0x7f0000000140)=""/111, 0x6f}], 0x2}, 0x40) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f0000000400)={{0x100000001, 0x164a8db2, 0x4, 0x7, 0x0, 0x2}, 0x101, 0x40, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040400000000000f9ffffff0000000000000000000000200000000000000000000000000000000000000030000000000000c75609e10f38e178c5361fc95f2549addf972f8d06ff6dff01620d35474ec7b6bf70a080934242a236b5d8a4e35cca39bf80a2594ddfb2b08189bd75810be40d73fba22a5d34e967229de1f286b6df5622772f1689c97e03a2c46089a556fa688dc3ce04073d77eb736de3e7bce061a31053c841a20f2c5770e1a66f930b01fd2876118907c9", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6000000}) 06:14:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) 06:14:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x40, 0x10100) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x3) [ 3413.226239][T12212] binder: 12090:12212 transaction failed 29189/-3, size 0-12288 line 3147 [ 3413.240868][T12335] binder: 12323:12335 got transaction to invalid handle 06:14:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x400040, 0x0) ioctl$RNDGETENTCNT(r2, 0x80045200, &(0x7f0000000140)) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000200)={0x3, &(0x7f0000000180)=[{0x1, 0x4b96, 0xffffffff, 0x81}, {0xfff, 0x2, 0x6, 0x9}, {0x8, 0x800, 0x1, 0x10001}]}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340406fa57ddd813138cb000000000000000000000000000000000000000000000030aeab876573cd00000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7000000}) 06:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 06:14:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000240)='/proc/capi/capi20ncci\x00', 0x80000, 0x0) ioctl$EVIOCGABS0(r2, 0x80184540, &(0x7f0000000280)=""/4096) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000140)=0x0) r5 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x0, 0x80) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r1, &(0x7f0000000200)={r5, r0, 0x9}) [ 3413.446814][T12667] binder: BINDER_SET_CONTEXT_MGR already set [ 3413.506300][T12667] binder: 12642:12667 ioctl 40046207 0 returned -16 06:14:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x8000000}) [ 3413.555246][T12754] binder_alloc: 12730: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x20000000000007a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:56 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="0098bd025a530f68000004000000"], 0x14}}, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x101102, 0x0) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000100)) write$selinux_attr(r1, &(0x7f00000000c0)='system_u:object_r:dhcpd_var_run_t:s0\x00', 0x25) 06:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x6000000}, 0x0) 06:14:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xa000000}) 06:14:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x101, 0x80) ioctl$TIOCNXCL(r1, 0x540d) r2 = syz_open_dev$binder(0x0, 0x0, 0x100000000000004) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x102, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3413.791533][T13087] QAT: Invalid ioctl 06:14:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x21000000}) [ 3413.828933][T13087] binder_alloc: 12730: binder_alloc_buf failed to map pages in userspace, no vma 06:14:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000009ceaa34ac7852b4f14c99108a2c2ac5b6d59908a6a7b3e0f4694a79beba3a4898b9e0e3205ff6dfc163f11428ba4e612a8953e3be0782a8376c9006d5ce6ebe33e092aea956c591ef4c2cf14cc4df409feb80a169647685c8817a4a98b", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:56 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x10001, 0x20000) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x810c5701, &(0x7f00000000c0)) [ 3413.905914][T13124] binder_alloc: 12730: binder_alloc_buf, no vma 06:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) [ 3413.970342][T13323] binder_alloc: 13282: binder_alloc_buf failed to map page at 20002000 in userspace 06:14:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x42000000}) 06:14:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x400000, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc058534f, &(0x7f0000000140)={{0x2, 0x6}, 0x0, 0x1, 0xfffffffffffffeff, {0x6cb836b2, 0x100000000}, 0x3, 0x3}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) getpeername(r2, &(0x7f0000000240)=@ll={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x80) sendmsg$nl_route(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=@ipv6_deladdr={0x70, 0x15, 0x500, 0x70bd27, 0x25dfdbff, {0xa, 0x78, 0x80, 0x0, r3}, [@IFA_FLAGS={0x8, 0x8, 0x10}, @IFA_CACHEINFO={0x14, 0x6, {0x5, 0xb5, 0x2, 0x1727}}, @IFA_CACHEINFO={0x14, 0x6, {0x2, 0x6, 0x1, 0xfd6}}, @IFA_LOCAL={0x14, 0x2, @remote}, @IFA_ADDRESS={0x14, 0x1, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xd}}}]}, 0x70}, 0x1, 0x0, 0x0, 0x8040}, 0x800) 06:14:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xc000000}, 0x0) [ 3414.181312][T13735] binder: BINDER_SET_CONTEXT_MGR already set 06:14:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:56 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='pids.current\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000000c0)=""/72) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000100301ff07008faca33d88c000001018dd"], 0x14}}, 0x0) 06:14:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x48000000}) 06:14:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000005c0)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) r2 = semget$private(0x0, 0x0, 0xa) semctl$GETVAL(r2, 0x3, 0xc, &(0x7f0000000100)=""/10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) timer_create(0x7, &(0x7f0000000400)={0x0, 0x18, 0x2, @thr={&(0x7f0000000240)="34ca20ece43256696424c9db0f41a888467e5dd97a6b99e71d3b73363101f92f5087b34bde204e90eec5d9c2971c416381b5809bea792ebd14535daf9144d5e16dab26943f808d2cfa8a06c1aaecf01fc7ebebf648e2df7f8e0b4c8be7093436b743d35c8ea4c7e2cb41173f1eed3b1fe1497be3f386664349f89a07da84e243c814caff3327320349e36b3d1b89a4761c593e60a3402825b60ac58213cb0f2a57946ebb2c290a1edc830d65aa7f4b4d59387e1e342cfa0174c497674dc1f889ccda5123fb7227c7a86ecaba648af92083df25ca972eead64ba7cabe4effde8feaf093403adbf9963078", &(0x7f0000000340)="3dd62a05e1a683653685483123902885b4c171836c204465ae4bb2076846e1dbb768f5bbe65c08041c8f322b17455f62754043b34f0f0fbafa15cdeea6af42a566789a3ea958acd948ddde1d500e8a2d72cfdf60b6d1a4afadeaec12801527b73917a4478150320c6707ce87464d12862b04a9b167b89cbe8d6c8847f6976f6411358789c024abd5ef4a7147ff67c407b679aa6e2557a27e43d315ac282d7d798c74972a4fb709f55588f61cc292c9f9937e92f35655c29c29"}}, &(0x7f0000000440)=0x0) timer_gettime(r3, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="0001040000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', 0x0, 0x8}, 0x10) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0405405, &(0x7f0000000580)={{0x2, 0x3, 0x401, 0x2, 0x5}, 0x8, 0x8000, 0xdd}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000004c0)='cgroup.events\x00', 0x0, 0x0) syz_open_dev$dspn(&(0x7f0000000600)='/dev/dsp#\x00', 0x4, 0x0) syz_open_dev$mice(&(0x7f0000000640)='/dev/input/mice\x00', 0x0, 0x80000) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000680)='/dev/dlm_plock\x00', 0x400000, 0x0) syz_open_dev$vbi(&(0x7f00000006c0)='/dev/vbi#\x00', 0x0, 0x2) openat$dsp(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dsp\x00', 0x4a0101, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000840)='/dev/autofs\x00', 0x101000, 0x0) openat$cgroup_ro(r0, &(0x7f0000000880)='pids.events\x00', 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000940)='/dev/usbmon#\x00', 0x9, 0x800) r5 = syz_open_dev$radio(&(0x7f0000000980)='/dev/radio#\x00', 0x2, 0x2) ioctl$GIO_SCRNMAP(r5, 0x4b40, &(0x7f00000008c0)=""/91) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='/dev/binder#\x00', r4}, 0x10) [ 3414.242010][T13735] binder: 13734:13735 ioctl 40046207 0 returned -16 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4c000000}) [ 3414.328310][T13930] binder_alloc: 13920: binder_alloc_buf size 12288 failed, no address space [ 3414.366823][T13930] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4096 (num: 1 largest: 4096) 06:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xe000000}, 0x0) 06:14:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10010, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000000301ff070008bda33d88c000001018dd034fdb454acda630d85167bb4396a9ac26447fa4eddf69fe1d2b60d8bf01f667f0886227a706bf4159f507a50c77f257589498f4ae18b38a0085329b10b47ef877367b"], 0x14}}, 0x0) 06:14:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.origin\x00', &(0x7f0000000200)=""/238, 0xee) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000e5000000000000000000000000000000000000000000000000000000000000000000000030000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3414.557625][T14372] binder_alloc: 14310: binder_alloc_buf, no vma 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x68000000}) 06:14:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3414.618810][T14462] binder: BINDER_SET_CONTEXT_MGR already set [ 3414.651168][T14462] binder: 14460:14462 ioctl 40046207 0 returned -16 06:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf000000}, 0x0) 06:14:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x2000000000000000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6c000000}) 06:14:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x0, 0x200000) ioctl$VIDIOC_G_TUNER(r1, 0xc054561d, &(0x7f00000000c0)={0x401, "815df3ad4d1dfd9dc62802626c7f3fe798e32d5f0245f2540f40d7a6a04163aa", 0x4, 0x205, 0xfff, 0x0, 0x5, 0x2, 0x8, 0xffffffff}) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:14:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x4, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000300)}) 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x74000000}) [ 3414.808022][T14636] binder_alloc: 14594: binder_alloc_buf size 12288 failed, no address space [ 3414.835944][T14636] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 8192 (num: 1 largest: 8192) 06:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7a000000}) 06:14:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x3, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x51b180, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_LOCK(r2, 0x4008642a, &(0x7f0000000180)={r3, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="00008f5c76c11d75000000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x129000, 0x0) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f0000000140)={0x3ff, 0x3, 0x5}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000180)={0x4, 0x101, 0x5, {0x8000, 0x4000, 0x8, 0x8000000000}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xbf000000}) 06:14:57 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d030000001018dd"], 0x14}}, 0x0) [ 3415.130553][T15184] binder_alloc: 15183: binder_alloc_buf, no vma [ 3415.168343][T15187] binder_alloc: 15183: binder_alloc_buf, no vma [ 3415.207953][T15241] binder: BINDER_SET_CONTEXT_MGR already set [ 3415.214481][T15241] binder: 15233:15241 ioctl 40046207 0 returned -16 06:14:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) 06:14:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfd000000}) [ 3415.295872][T15241] binder_alloc: 15183: binder_alloc_buf, no vma 06:14:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x80, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x64, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x13}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7f}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xfffffffffffffeff}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="2abaa8acac7200f1cb6a50ba20d3e2d9"}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000041}, 0x80) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) bind$unix(r1, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e24}, 0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00634040000001000000e95b0d1756dca41c2b989dab241656fe000000000000000000000000000000000000004000000000000000000000000000000030000040000000dce6", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000100)={r2}) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfdfdffff}) 06:14:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000000700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3415.446216][T15668] binder: 15663:15668 got transaction to invalid handle 06:14:58 executing program 4: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000200)={0x0, 0xc4, "ecec84f8e3b90955276d4a680386da47ecb53f4d227bb06c22da8777acc841d69efaa3b243c655ab9b46cf31f751818323ba45cc619eb60b14adf9ff1706b50d2b4f716c2e2176871fad470f7b542f688ca3729cbe0bab644ee6ecc20457426afbccf2fb33541282e7f9dbee4bd1d2c8d063dd95dad66f6eba6765aeb2c1a696c29a80f65e41e05bc25b0e642359c7d35b0f5e276407618f96c7547e3b95b83d2543f0c7a25ca490b4c1b9721d26631dd2c8e8522efc455aeb2b89391c04bc72ef688265"}, &(0x7f0000000000)=0xcc) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000140)={r1, 0x101}, 0x8) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x65580000}, 0x0) 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffdfd}) [ 3415.529462][T15720] binder: 15719:15720 got transaction with invalid offset (0, min 0 max 0) or object. [ 3415.595173][T15745] binder: BINDER_SET_CONTEXT_MGR already set 06:14:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3415.639794][T15745] binder: 15742:15745 ioctl 40046207 0 returned -16 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x100000000000000}) 06:14:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000040)={'ip6gretap0\x00', 0x4}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x803, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[], 0x183}}, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3, 0x62040) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x801}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r2, 0x402, 0x70bd28, 0x25dfdbfe, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x2, @link='broadcast-link\x00'}}}, ["", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x14) [ 3415.699051][T16031] binder: 15997:16031 got transaction with invalid offsets ptr 06:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x81000000}, 0x0) 06:14:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xfffffffffffffffb) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x200000000000000}) 06:14:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000001200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3415.864645][T16361] binder: BINDER_SET_CONTEXT_MGR already set 06:14:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x701400, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f0000000140), &(0x7f0000000180)=0x4) socket(0x0, 0x1, 0x1ff) 06:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) [ 3415.905927][T16361] binder: 16359:16361 ioctl 40046207 0 returned -16 [ 3415.937845][T16509] binder: 16507:16509 got transaction with invalid offset (0, min 0 max 0) or object. 06:14:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRESHEX=r0, @ANYRESDEC, @ANYRES16=r0, @ANYRES64=r0, @ANYRES64]], 0x8}}, 0x0) 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x300000000000000}) [ 3416.013437][T16553] binder_alloc: 16532: binder_alloc_buf, no vma 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x400000000000000}) 06:14:58 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000540)='/dev/mixer\x00', 0x40, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x15) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000d0d0850000559f9b7e8ca5dc80333cb4af0000000000002b807d0a7100000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x56, 0x0, &(0x7f0000000580)="172129f920f5fefe08a712e063e46a9fb77aa01ed4aaa15b05e54e6fe602752a52d72191f07b0529338fae5f149f4094f7677cde6e0525d8dc88c0de141e0d81f5211da83caaeced59b2af8750a92afdbf7f88e56844"}) recvmsg(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000000)=""/38, 0x26}, {&(0x7f0000000200)=""/23, 0x17}, {&(0x7f0000000240)=""/162, 0xa2}, {&(0x7f0000000300)=""/67, 0x43}], 0x4, &(0x7f00000003c0)=""/163, 0xa3}, 0x1) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000004c0), &(0x7f0000000500)=0x4) 06:14:58 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0xffffffffffffff29, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYRES16=0x0], 0x1}}, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000040)=0x20, 0x8) 06:14:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xd, &(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000180)=r2, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:58 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x500000000000000}) 06:14:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0) [ 3416.202008][T16885] binder: BINDER_SET_CONTEXT_MGR already set [ 3416.228463][T16885] binder: 16874:16885 ioctl 40046207 0 returned -16 06:14:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000002000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3416.317999][T16981] binder: 16980:16981 got transaction with invalid offsets ptr 06:14:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x600000000000000}) 06:14:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000180)={0x0, 0x4, 0x10ef, 0x5}) r2 = open(&(0x7f0000000340)='./file0\x00', 0x80080, 0x2) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x10, 0x0, &(0x7f0000000200)=[@decrefs, @acquire={0x40046305, 0x2}], 0xa1, 0x0, &(0x7f0000000240)="c5ef0087cf3e69bd49581310f23c5aac65d127761beb0a6b7ff71dfc0c915ee5379d4f92d55db5a99efb71e5d5354c2183587e033e6be14c7fbb76bcce4e549ecc3bf90b2dd2a622a458a4b5aac0d28bd245b974c1983facfe1c890abe769107fefe48fdc2661cfc49518535df1d88ac645e14d63695ed0116c2f3e13437fb36ede3e000efcaca077c1ec62b916bdaf4b4579a3be4701fafde5319618e10e1f3e0"}) ioctl$KVM_ASSIGN_SET_MSIX_NR(r3, 0x4008ae73, &(0x7f0000000140)={0x2, 0x81}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:59 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/anycast6\x00') ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000100)) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r0, 0xc0305616, &(0x7f00000001c0)={0x0, {0x100000000, 0xffffffffffffffe0}}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x2, 0x0) connect$l2tp(r0, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @loopback}, 0x2, 0x2, 0x2, 0x2}}, 0x2e) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xaf580000}, 0x0) [ 3416.409605][T17274] binder: 17260:17274 got transaction with invalid offset (0, min 0 max 0) or object. [ 3416.429987][T17274] binder_transaction: 19 callbacks suppressed [ 3416.430006][T17274] binder: 17260:17274 transaction failed 29201/-22, size 0-12288 line 3241 06:14:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x700000000000000}) [ 3416.494091][T17314] binder: 17310:17314 DecRefs 0 refcount change on invalid ref 0 ret -22 06:14:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000300)={0x0, @loopback, @loopback}, &(0x7f0000000340)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xf, 0x10, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x3, 0x0, 0x6, 0x0, 0x8, 0xffffffffffffffff, 0xc}, @jmp={0x5, 0x6d, 0x0, 0x0, 0xb, 0x6, 0xffffffffffffffff}, @ldst={0x3, 0x1, 0x1, 0x5, 0x9, 0x59, 0xc}, @call={0x85, 0x0, 0x0, 0x39}, @initr0={0x18, 0x0, 0x0, 0x0, 0xffffffff00000000, 0x0, 0x0, 0x0, 0xfffffffffffff5f5}, @ldst={0x3, 0x3, 0x7, 0x5, 0x3, 0xfffffffffffffff8, 0xfffffffffffffff0}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, @map={0x18, 0xb, 0x1, 0x0, r2}, @alu={0x7, 0x3, 0x9, 0xe, 0x5, 0x0, 0xfffffffffffffffc}, @exit]}, &(0x7f0000000200)='GPL\x00', 0x401, 0xbc, &(0x7f0000000240)=""/188, 0x41f00, 0x1, [], r3, 0xf}, 0x48) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3416.557073][T17314] binder: 17310:17314 Acquire 1 refcount change on invalid ref 2 ret -22 06:14:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000003000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x4, 0x0) ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000140)={'team0\x00', 0x10001}) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f0000000180)) 06:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xdefe0000}, 0x0) [ 3416.671294][T17558] binder: 17556:17558 got transaction with invalid offsets ptr [ 3416.708961][T17558] binder: 17556:17558 transaction failed 29201/-14, size 0-12288 line 3193 06:14:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x800000000000000}) 06:14:59 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x7ff, 0x40000) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4018641b, &(0x7f00000001c0)={&(0x7f0000fff000/0x1000)=nil, 0x5167, 0x2, 0x10, &(0x7f0000ffd000/0x3000)=nil, 0x80000001}) ioctl$DRM_IOCTL_ADD_MAP(r1, 0xc0186415, &(0x7f0000000200)={0x0, 0x0, 0x1, 0x8, &(0x7f0000ffc000/0x2000)=nil, 0x3}) write$nbd(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="6744669800000000000000461dfaa594cb043f22343d9fd1096252c2d4208f4e3c127dff0b2a776b8d94635bb4112575c1f603aa2c6cf08a4b8258fb3f11b99ff10da946d43391ba93495705c083c649712882b4840007ae332d019f5dfac5340facc410509ff7aa466d14d78258e88ac2ede00b31d5e6db6f964f4438a58109bbdc8c83d8e66630b28b643657ec85105855b5764bdf5e62c72f0f20f22bd155c3f9451f508aa1a1e0fafe0fec3c414d96412dfd62d42b6bcaad57c3539cea2fafb309a7d93c7f83d6b139a1ddf860d18a"], 0xd6) 06:14:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xa00000000000000}) 06:14:59 executing program 2: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x3, 0x80800) creat(&(0x7f00000003c0)='./file0\x00', 0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e20, 0x6, @remote, 0x1000}}, 0xbe00, 0x100000001}, &(0x7f0000000140)=0x88) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000180)={r1, 0x101}, 0x8) fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0)='trusted.overlay.origin\x00', &(0x7f0000000380)='y\x00', 0x2, 0x2) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYBLOB="00000054710b06007a153b34dd179f0f8de36c671b1b66080b3c37f4d8c00a053e04653e29fbf7a0ca99a29f78e450af258cfec95a29df9663755e7351a705fb920075f3bfb02f7b741b4f23122c25a9ef727681fabb171fffd2456d123a91ed2fae0509cbdaf3d787fa23601960cef247aed50000000400000000000000000000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3416.824242][T17853] binder: BINDER_SET_CONTEXT_MGR already set [ 3416.845932][T17853] binder: 17840:17853 ioctl 40046207 0 returned -16 [ 3416.847097][T17842] binder: 17790:17842 got transaction with invalid offset (0, min 0 max 0) or object. [ 3416.897723][T17842] binder: 17790:17842 transaction failed 29201/-22, size 0-12288 line 3241 [ 3416.949555][T18051] binder: 18036:18051 got transaction to context manager from process owning it 06:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 06:14:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x40101, 0x0) 06:14:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2100000000000000}) [ 3416.990538][T18051] binder: 18036:18051 transaction failed 29201/-22, size 0-12288 line 2985 06:14:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4200000000000000}) [ 3417.114982][T18311] binder: BINDER_SET_CONTEXT_MGR already set [ 3417.152124][T18311] binder: 18276:18311 ioctl 40046207 0 returned -16 06:14:59 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) ioctl$LOOP_CLR_FD(r1, 0x4c01) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:14:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000003f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:59 executing program 2: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000280)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)={0xd, 0x9, 0x7, 0x4b5, 0x2, 0xffffffffffffff9c, 0x5}, 0x2c) tee(r0, r1, 0xffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:14:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 06:15:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4800000000000000}) [ 3417.362459][T18613] binder: 18606:18613 got transaction with invalid offsets ptr [ 3417.366673][T18627] binder: BINDER_SET_CONTEXT_MGR already set [ 3417.388705][T18627] binder: 18619:18627 ioctl 40046207 0 returned -16 [ 3417.390048][T18613] binder: 18606:18613 transaction failed 29201/-14, size 0-12288 line 3193 06:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0) [ 3417.416805][T18627] binder: 18619:18627 got transaction with invalid offset (0, min 0 max 0) or object. [ 3417.438803][T18627] binder: 18619:18627 transaction failed 29201/-22, size 0-12288 line 3241 06:15:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4c00000000000000}) 06:15:00 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x10000) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000080)=0x7ff) r1 = add_key(&(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="f2b2f318f1c344f3314e5ecad929fc40c56df94d07dfb138afad2de04a103aa2", 0x20, 0xfffffffffffffff9) r2 = add_key(&(0x7f0000000380)='ceph\x00', &(0x7f00000003c0)={'syz', 0x0}, &(0x7f0000000400)="ff111b39972847b081ffa9893d4700642123cc2417f165ecd72e091c7f68f7b61c3dc1facdc4b902024671af5d882dd2bb2666a2b6c78094186eeb68fcbc43e6b713f69409d94e892649b6b6b50ac44ee202df707eaa9700afb3c2c06980ccdbc99ce77ea70400f1532d1a71122facc0e0b50b888816835b2a2c6af15d46c0d4661eb842ec1c790003c7544b362fc9467c1c8d4170d79ece2425798cd9b811d235dc002cf434272375cdc1411befb7d51ca84f334f4a2c", 0xb7, 0xfffffffffffffff9) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000340)='pkcs7_test\x00', &(0x7f00000004c0)=@keyring={'key_or_keyring:', r2}) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000003000000000000026ee4d7e4e449b373162338a7cef48196ab34e2349d0c05c2063f6c6df9f6cb6aba17898241a340cd58eb955de470b4ec0dbf8b559508665588717de2a6871447096f1fc2ab036df41c25c3ec27d7e284369e3050d3c9671bff4260269675a49687d3d2642727a34de2530be44c1f840d64d68a134969e82903de1855dcae3761a1ca1290e0e4130bb9f6aa3146b397b7967862cbdc11e8667ec69b419a947eb23249118fb12a6b694bf80809b17ac4383a46e6b9d9d5258a1f501c8ae8bc962c9b37cd5dc8880dc11ff946a60e1d96f857938661a78f3c850c0052c746eb5f44a48398984", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="d365aecf9baf616a"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[]}}, 0x0) 06:15:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000004000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6800000000000000}) [ 3417.690989][T19234] binder: 19211:19234 unknown command 0 [ 3417.713041][T19245] binder: BINDER_SET_CONTEXT_MGR already set [ 3417.722213][T19234] binder: 19211:19234 ioctl c0306201 20000040 returned -22 06:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 06:15:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000040)={0x0, 0x198, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="141018d20000000000000000"], 0x1f}}, 0x0) [ 3417.741287][T19245] binder: 19243:19245 ioctl 40046207 0 returned -16 [ 3417.774073][T19250] binder_alloc: 19211: binder_alloc_buf failed to map page at 20002000 in userspace 06:15:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x6c00000000000000}) 06:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) [ 3417.823522][T19250] binder: 19247:19250 transaction failed 29201/-12, size 0-12288 line 3147 06:15:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000040)=0x9, 0x4) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:15:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000140)={0x5, [0x2, 0x10000, 0xf086, 0x525, 0x4]}, &(0x7f0000000180)=0xe) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e23, 0x40, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1000}}, 0x4, 0x81, 0x8, 0x956d, 0xffffffffffffffff}, &(0x7f00000002c0)=0x98) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000300)={r3, 0x7}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7400000000000000}) 06:15:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000200)={0x0, 0x100, 0x20, 0x5, 0x7, 0x81, 0xfffffffffffffffe, 0x3, {0x0, @in={{0x2, 0x4e20, @rand_addr=0x800}}, 0x1, 0x8000, 0x2, 0x20, 0x1f02}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f00000002c0)={r3, @in={{0x2, 0x4e20, @multicast2}}, 0x1000, 0x5, 0x6, 0x3f7d51eb, 0x1000}, &(0x7f0000000180)=0x98) madvise(&(0x7f0000001000/0x4000)=nil, 0x4000, 0xd) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3418.043359][T19696] binder: 19681:19696 got transaction with invalid offsets ptr [ 3418.070139][T19696] binder: 19681:19696 transaction failed 29201/-14, size 0-12288 line 3193 06:15:00 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 06:15:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000004800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x7a00000000000000}) [ 3418.102041][T19768] binder: BINDER_SET_CONTEXT_MGR already set [ 3418.130618][T19768] binder: 19759:19768 ioctl 40046207 0 returned -16 06:15:00 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd7bbf053069291126e7d00fc2d364e1fe8eb3bbcbdbc7858da2b81a49558782bbd26aa54ccb6aa450ef5733e2adf4a3d7dd92ccb430f158cb04678c234d3b1b8d226b1d065c3affa7e56396846894fa2dbac9f08d62399670e0ea3d458b591f5b85dcadb58f4243be5ac8495af67e403d4a113d80893a8401d3a5d2e5ed224553656b62023635fd10b4825557363789c0804988e11b9d19e514c7daf7088534c5989c02b75d98cabef66ef6636bc058f6f36dcba91422760f975a988e652551da9c22d336ad34bf00"], 0x14}}, 0x0) 06:15:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="0000000000000000db2e5513dd8eebcf07c44f366350f6806f298099e480eba46b653e499c05884e256adde09569857bdf32b1a4382325c643aa954c5ad64918630301a7898b331f26c1e4212ff1eb846238eb44bc25eb77163020d52701e95bc091188b0d8571703c27b75ff2fb926b27"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3418.277984][T20033] binder: 19913:20033 got transaction with invalid offset (0, min 0 max 0) or object. [ 3418.316785][T20033] binder: 19913:20033 transaction failed 29201/-22, size 0-12288 line 3241 06:15:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x3fffa) ioctl$KDDELIO(r1, 0x4b35, 0x5) r2 = getuid() lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f00000003c0)='./file0\x00', r2, r3) r4 = getuid() getresgid(&(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) fstat(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = getgid() fsetxattr$system_posix_acl(r1, &(0x7f00000001c0)='system.posix_acl_default\x00', &(0x7f0000000340)={{}, {0x1, 0x2}, [{0x2, 0x2, r2}, {0x2, 0x3, r4}], {0x4, 0x6}, [{0x8, 0x2, r5}, {0x8, 0x1, r6}, {0x8, 0x5, r7}], {0x10, 0x2}, {0x20, 0x5}}, 0x4c, 0x3) r8 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="0000000000000000a608ea47535c6888d9ef24cb0e2a51dca4398b1ba400a4f968ebb7a63c95beda9b1eac7c25a890f40d2b3054da997da46f8259ec3b433b914963a61c1c9fdb85713bfea5ad721164709f2b6ffa8571cfe064ae2ed5d00cb85c97d18f"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xbf00000000000000}) 06:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x40030000000000}, 0x0) [ 3418.415307][T20233] binder: 20232:20233 got transaction with invalid offsets ptr [ 3418.430314][T20230] binder_alloc: 20232: binder_alloc_buf size 12288 failed, no address space 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfd00000000000000}) 06:15:01 executing program 0: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={0xffffffffffffff9c}) r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video2\x00', 0x2, 0x0) sendfile64(r0, r1, &(0x7f0000000100), 0xf5bf) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3418.458328][T20230] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) [ 3418.494130][T20233] binder: 20232:20233 transaction failed 29201/-14, size 0-12288 line 3193 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfdfdffff00000000}) 06:15:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000004c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)}) 06:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0) 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2}) 06:15:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x101001, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x4e23, @remote}}, 0x0, 0x3, 0x0, "16a1084085ae6173a2015c8f6a5b33d9ed0811cb95c67330d96caa5282b6c8f177c84283d17a6dd49fc96d277602c7a53739b14a55e7566149b8eae22add1ebb5517945e725f5a60cce5e02de74ec06f"}, 0xd8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="a001000000000071"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3418.693140][T20618] binder_alloc: 20232: binder_alloc_buf, no vma 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}) [ 3418.759263][T20650] binder: BINDER_SET_CONTEXT_MGR already set [ 3418.765510][T20650] binder: 20648:20650 ioctl 40046207 0 returned -16 [ 3418.780606][T20650] binder: 20648:20650 got transaction with invalid offsets ptr 06:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 06:15:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}) 06:15:01 executing program 4: syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x7, 0x40) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:01 executing program 0: syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x7fff, 0x100) r1 = getpid() sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x100) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'veth0_to_bond\x00', 0x2000}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe2(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000200), &(0x7f0000000240)=0x4) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="143d88bfffef1018dd3ed489874e8d5883d6d43705"], 0x14}}, 0x0) r4 = socket(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pkey_alloc(0x0, 0x0) pkey_alloc(0x0, 0x2) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000000300)=0x7db8, 0x4) futimesat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0) gettid() r5 = syz_open_dev$amidi(&(0x7f00000003c0)='/dev/amidi#\x00', 0x7ffd, 0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) ioctl$EVIOCSABS2F(r5, 0x401845ef, &(0x7f00000002c0)={0x4bf1af83, 0x3f, 0x9, 0x67cc, 0x9, 0xb097}) tkill(0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(0xffffffffffffffff, 0x111, 0x5, 0xffffffff, 0x4) perf_event_open(&(0x7f0000000000)={0xfffffffffffffffc, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x2a9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_config_ext={0x2, 0x1ff}, 0x0, 0x0, 0x0, 0xf}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) futimesat(r6, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') setxattr$security_smack_entry(&(0x7f0000000200)='./file0\x00', 0x0, &(0x7f0000000340)='/dev/amidi#\x00', 0xc, 0x2) openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cuse\x00', 0x2, 0x0) 06:15:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000006000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3419.023176][T21141] binder: 21129:21141 got transaction with invalid offsets ptr [ 3419.038509][T21155] binder: BINDER_SET_CONTEXT_MGR already set 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5}) [ 3419.073170][T21155] binder: 21132:21155 ioctl 40046207 0 returned -16 06:15:01 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) [ 3419.160521][T21347] binder: 21267:21347 got transaction with invalid offset (0, min 0 max 0) or object. 06:15:01 executing program 2: openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video36\x00', 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x200, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB=' \x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6}) 06:15:02 executing program 4: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) write$FUSE_BMAP(r0, &(0x7f0000000140)={0x18, 0x0, 0x5, {0x1000}}, 0x18) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) madvise(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xb) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3419.388274][T21708] binder_alloc: 21705: binder_alloc_buf failed to map page at 20001000 in userspace 06:15:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7}) 06:15:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000006800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3419.429762][T21718] binder: BINDER_SET_CONTEXT_MGR already set [ 3419.456069][T21718] binder: 21716:21718 ioctl 40046207 0 returned -16 [ 3419.488717][T21718] binder_alloc: 21705: binder_alloc_buf failed to map page at 20001000 in userspace 06:15:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="0019000000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x300000000000000}, 0x0) 06:15:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8}) 06:15:02 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x4000, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40046607, &(0x7f0000000100)=0x3f) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3419.704279][T21888] binder_alloc: 21705: binder_alloc_buf, no vma [ 3419.711408][T21930] binder: BINDER_SET_CONTEXT_MGR already set 06:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) [ 3419.744737][T21930] binder: 21907:21930 ioctl 40046207 0 returned -16 06:15:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xa}) 06:15:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x218042, 0x0) ioctl$CAPI_INSTALLED(r1, 0x80024322) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x9000)=nil, 0x9000, 0xd) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x600000000000000}, 0x0) [ 3419.950724][T22393] binder: 22391:22393 got transaction with invalid offsets ptr 06:15:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x21}) 06:15:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000006c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40000, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045540, &(0x7f00000000c0)=0x7fff) [ 3420.055689][T22585] binder: BINDER_SET_CONTEXT_MGR already set 06:15:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x42}) [ 3420.137059][T22585] binder: 22584:22585 ioctl 40046207 0 returned -16 06:15:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x48}) 06:15:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:02 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) [ 3420.194868][T22734] binder_alloc: 22391: binder_alloc_buf, no vma 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4c}) 06:15:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000900000000000000000000000000000000000000000000cbe80000000000000030000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3420.280902][T22876] binder: 22834:22876 got transaction to context manager from process owning it 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x68}) 06:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xc00000000000000}, 0x0) [ 3420.387301][T23055] binder_alloc: 23047: binder_alloc_buf size 71888 failed, no address space [ 3420.411710][T23055] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6c}) 06:15:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000007400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:03 executing program 0: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000300253c63e2a1c1a7fd140775e90158dc190000000000003d88c000001018dd"], 0x14}}, 0x0) [ 3420.560134][T23445] binder: BINDER_SET_CONTEXT_MGR already set 06:15:03 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000380)={{0x0, 0x40100000001}, {0xf, 0xbf}, 0x0, 0x0, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff]}) syz_open_dev$binder(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xb5f, 0x0, 0x1b, 0x1, "288f25b1452f452b903768058bccdc3ad9527202a1412d6378cb07874c64701bc0ed071aa14f1358fbbf5ed3dea48edd54f653d62346b8963c5173b10fb84d42", "402399b029d1049f5f7e128ed890370d468cc67e594eaa45adf3521d2a202f0b", [0x1, 0x3e33]}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000740)=ANY=[@ANYBLOB="726177000000001300000000000000000000000000000000000000190000000002000000000000000000000000000000000000000000000000002000000000000000000000000000"], 0x48) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x61) write$binfmt_elf64(r3, &(0x7f00000007c0)=ANY=[@ANYBLOB="7f454c460303cb01070000000000000003003f00080000009200000000000000400000000000000087010000000000000000000002003800010005000000008000000060f50d0000cc040000000000001a07000000000000060000000000000004000000000000000700000000000000b60c00000000000057e57464ee06000000000000000000000800000000000000c1ffffffffffffff01010000000000000000000000000000ff0100000000000078bf10cf68843f7a529ad4e83a4c5bfe2d8c8ae8c3f42ae300eb66ee826eef704d5198c47ce62d5e427976237b9089db17bdf11d4f95a67ed23247c701b927b56b5c27281a9e6c444371598f48dd9ac4d54cbfafe10401bb07d96d34dd764bd654f3d49c11eceef99c3ffacec3b8455b8b4ff8f2c6d0061a553c4ddfc08ea0b23c88215901203e2a42b9d0a30f57b894863a2a9de59c15c4c0f9f1d2173992934ceff70f62f1baedabf80676b2857d47b6bea511b389adc25bb996723aa500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001ff8208600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f1e1a289cd5828e7188174747400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024a575530f87000000000000000000000000000000000000000000000000000000008c745fe4c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x570) ioctl$VIDIOC_S_FMT(r3, 0xc0cc5605, &(0x7f0000000140)={0x5, @sliced={0x1, [0xfffffffffffffffd, 0x8, 0xfffffffffffffffc, 0x7f, 0x80000000, 0x9c, 0x2dee, 0x2, 0x1, 0x7fffffff, 0x3f, 0x0, 0x9, 0xffffffff, 0x4, 0x3, 0x3f, 0x8, 0x1637, 0x7fff, 0x7, 0x1, 0x3, 0x85a3, 0x8, 0x5, 0x6, 0x9, 0x4, 0x7, 0x4, 0xffffffff, 0x7fff, 0x2, 0x7f1, 0x4, 0x7, 0x1, 0x101, 0x99, 0xfffffffffffffc00, 0x138d, 0xfffffffffffffffc, 0x10000, 0x7, 0xff, 0x7, 0x3ff], 0x2}}) ioctl$KVM_ARM_SET_DEVICE_ADDR(r2, 0x4010aeab, &(0x7f0000000000)={0x81, 0x1}) 06:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xe00000000000000}, 0x0) [ 3420.635645][T23445] binder: 23439:23445 ioctl 40046207 0 returned -16 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x74}) 06:15:03 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0xffffffffffffffb7, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400a8691d039811673eaecad0026266193b00400301001018dda73591ac4056e0d0ffe874351fbbd55a63216b1483b7da45547c60dc1a8dc3f7deeb6465ba7316cd"], 0x42}}, 0x0) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000001280)={@local, 0x0}, &(0x7f00000012c0)=0x14) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x400c00, 0x0) setsockopt$inet_group_source_req(r2, 0x0, 0x2f, &(0x7f00000001c0)={0x1bf1c8a9, {{0x2, 0x4e21, @local}}, {{0x2, 0x4e22, @loopback}}}, 0x104) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000300)='/dev/video36\x00', 0x2, 0x0) sendto(r0, &(0x7f0000000140)="86164725b42014369a6775204c6e450c72485683b1bdd25bf6bd5086fdb1906881daacebd3ba3c604f3018ffe2f0a9effd5bfa8e05ba8d5dbc535359fbd3f1b445e2847c4483e6f12f8f584eb924253e07f43608bd1a35275a7b5703b926e2d0313ad11f7cd3b1b93c3eafcf4e8abc4ae9f52cf110", 0x75, 0x20000000, &(0x7f0000001300)=@hci={0x1f, r1, 0x3}, 0x80) 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7a}) 06:15:03 executing program 2: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'L-', 0xffffffff}, 0x28, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0xfa, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000010167c99a715119c20dd848fb885a3b0591fef554035d558b5e1928d5f5c2d53d9a48034dee67749960b955f9c3eea950e500fe5123017a05d656d2cca1c2e4ead01df5e3221529cb5f6c0", @ANYBLOB="cf4a274e27b9470877a42e607c0404f68eb68428bf312464b3d64ca83230abc195ffb59a44535b5d597f25ba45b97b94103f0e099336352590cb4fde0024ffce3900b33d0b049ba5df19833c211a09a7cbc8f8e92cb7106b89bd23601d8928b6ee9c0e753ec1d44863", @ANYRESHEX=r0], 0x0, 0x0, &(0x7f0000000300)}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x80) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000000200)={[], 0x2c, 0x1ff, 0xb0c, 0x0, 0xd9, 0x10000, 0x7000, [], 0xb00}) 06:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf00000000000000}, 0x0) 06:15:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) mmap$binder(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x2, 0x5050, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xbf}) [ 3420.915692][T23974] binder: 23973:23974 got transaction to context manager from process owning it 06:15:03 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x3, 0x2) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f00000000c0)=0x9, &(0x7f0000000100)=0x4) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c0000010180a14e23cdcff62ec46004fdd"], 0x14}}, 0x0) 06:15:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000007a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3420.998339][T24106] binder: BINDER_SET_CONTEXT_MGR already set 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfd}) [ 3421.050853][T24106] binder: 24103:24106 ioctl 40046207 0 returned -16 [ 3421.090001][T24246] binder_alloc: 23973: binder_alloc_buf failed to map pages in userspace, no vma 06:15:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x1, 0x40) ioctl$KVM_GET_PIT2(r1, 0x8070ae9f, &(0x7f0000000140)) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3421.109026][T24605] binder: undelivered TRANSACTION_ERROR: 29201 06:15:03 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) 06:15:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x300}) 06:15:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) tee(r0, r0, 0x7, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:04 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000b5101800deedcbda276a16fd437f93518116f0d16b281cdb853837eee2772d1a6e29e09fc2ee8338c2a8062b428e"], 0x14}}, 0x0) [ 3421.340294][T24673] binder_alloc: 24665: binder_alloc_buf failed to map page at 20002000 in userspace 06:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x6000000000000000}, 0x0) 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x500}) 06:15:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000000300000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x20011, r1, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$TIOCLINUX4(r2, 0x541c, &(0x7f0000000380)) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000300)=0x4) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000140)={0xc9, 0x3, {0x3, 0x3, 0xc3b, 0x3, 0x7}}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040000000000000000000000000000000ff090000000000cc19e5317fc0a9dd00000000e821ae852b813b00000000000000b988ca0076a8589340e2c32175424265f8e69c2677921b16fed23b5bffe5b85d0ccc911813ee284544b0fdb6296c025f841aa5e4888ba9d639e597e688707ad3855d11ec8dac24fc00fa8494e5b13e61a99498594c00413fed62fc40c7ebc04f8c55f2737d2777174492ccc61a8aa880913172abb620b34a363fb7b86dc73d147d4ef9a93aba3c119bc396b3941710e9743ea3a81f0967128da88aade6f2cf962c54c32953bfd0", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="00009c19f1020000"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x600}) [ 3421.610778][T24951] binder_alloc: 24939: binder_alloc_buf size -9139064035878633408 failed, no address space [ 3421.625872][T24951] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 3421.646806][T24937] binder_alloc: 24939: binder_alloc_buf failed to map page at 20002000 in userspace 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x700}) [ 3421.658511][T24951] binder_transaction: 17 callbacks suppressed [ 3421.658533][T24951] binder: 24939:24951 transaction failed 29201/-28, size -9139064035878633472-59 line 3147 06:15:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x406, r2) ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000140)={0xffffffff, 0x565d5d59, 0x800000000003, @discrete={0x0, 0x4}}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x6558000000000000}, 0x0) [ 3421.703024][T24937] binder: 24896:24937 transaction failed 29201/-12, size 0-12288 line 3147 06:15:04 executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x8000, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@int=0x2d2bc7fa, 0x4) 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xa00}) [ 3421.764322][T25005] binder: BINDER_SET_CONTEXT_MGR already set [ 3421.783935][T25005] binder: 25004:25005 ioctl 40046207 0 returned -16 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2100}) 06:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x8100000000000000}, 0x0) 06:15:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x484002, 0x0) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000000140)=[0x1, 0x32]) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000180)=0x3) 06:15:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000004080)='/dev/input/mouse#\x00', 0xc, 0x80000) ioctl$PPPIOCSCOMPRESS(r2, 0x400c744d) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000006b80)=[{{&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10}, 0x80, &(0x7f00000015c0)=[{&(0x7f0000000200)=""/67, 0x43}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/224, 0xe0}, {&(0x7f0000001380)=""/166, 0xa6}, {&(0x7f0000001440)=""/140, 0x8c}, {&(0x7f0000001500)=""/177, 0xb1}], 0x6, &(0x7f0000001600)=""/160, 0xa0}, 0x2c1}, {{&(0x7f00000016c0)=@generic, 0x80, &(0x7f0000001980)=[{&(0x7f0000001740)=""/90, 0x5a}, {&(0x7f00000017c0)=""/244, 0xf4}, {&(0x7f00000018c0)=""/131, 0x83}], 0x3, &(0x7f00000019c0)=""/87, 0x57}, 0xa0}, {{0x0, 0x0, &(0x7f0000002c80)=[{&(0x7f0000001a40)=""/181, 0xb5}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/31, 0x1f}, {&(0x7f0000002b40)=""/94, 0x5e}, {&(0x7f0000002bc0)=""/122, 0x7a}, {&(0x7f0000002c40)=""/51, 0x33}], 0x6, &(0x7f0000002cc0)=""/15, 0xf}, 0x3}, {{&(0x7f0000002d00)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000004040)=[{&(0x7f0000002d80)=""/4096, 0x1000}, {&(0x7f0000003d80)=""/78, 0x4e}, {&(0x7f0000003e00)=""/243, 0xf3}, {&(0x7f0000003f00)=""/188, 0xbc}, {&(0x7f0000003fc0)=""/45, 0x2d}, {&(0x7f0000004000)=""/27, 0x1b}], 0x6, &(0x7f0000004080)}, 0x80000000}, {{&(0x7f00000040c0)=@ethernet={0x0, @remote}, 0x80, &(0x7f00000041c0)=[{&(0x7f0000004140)=""/78, 0x4e}], 0x1, &(0x7f0000004200)=""/182, 0xb6}, 0x8000}, {{&(0x7f00000042c0)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, &(0x7f0000004440)=[{&(0x7f0000004340)=""/254, 0xfe}], 0x1, &(0x7f0000004480)=""/4096, 0x1000}, 0x9}, {{0x0, 0x0, &(0x7f00000055c0)=[{&(0x7f0000005480)=""/167, 0xa7}, {&(0x7f0000005540)=""/73, 0x49}], 0x2, &(0x7f0000005600)=""/166, 0xa6}, 0x80000000}, {{&(0x7f00000056c0)=@x25, 0x80, &(0x7f0000006a80)=[{&(0x7f0000005740)}, {&(0x7f0000005780)=""/5, 0x5}, {&(0x7f00000057c0)=""/4096, 0x1000}, {&(0x7f00000067c0)=""/43, 0x2b}, {&(0x7f0000006800)=""/15, 0xf}, {&(0x7f0000006840)=""/235, 0xeb}, {&(0x7f0000006940)=""/150, 0x96}, {&(0x7f0000006a00)=""/95, 0x5f}], 0x8, &(0x7f0000006ac0)=""/132, 0x84}, 0x7}], 0x8, 0x10000, &(0x7f0000006c80)={0x77359400}) fsetxattr$security_smack_transmute(r0, &(0x7f0000005740)='security.SMACK64TRANSMUTE\x00', &(0x7f0000006d00)='TRUE', 0x4, 0x1) ioctl$IMGETVERSION(r3, 0x80044942, &(0x7f0000006cc0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r4 = msgget$private(0x0, 0xa4) msgctl$IPC_INFO(r4, 0x3, &(0x7f0000000000)=""/27) [ 3422.018298][T25562] binder_alloc: 25561: binder_alloc_buf failed to map page at 20002000 in userspace [ 3422.036903][T25564] binder: BINDER_SET_CONTEXT_MGR already set 06:15:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000001000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:04 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="14008fbda33d88c000001018dd00000000000000"], 0x14}}, 0x0) 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4200}) [ 3422.065392][T25562] binder: 25561:25562 transaction failed 29201/-12, size 0-12288 line 3147 [ 3422.075519][T25564] binder: 25563:25564 ioctl 40046207 0 returned -16 06:15:04 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4800}) 06:15:04 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x88a8ffff00000000}, 0x0) 06:15:04 executing program 0: socket$bt_rfcomm(0x1f, 0x0, 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) 06:15:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x244a00, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x7, @mcast2, 0x8}, @in6={0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0x28}, 0x1}, @in6={0xa, 0x4e20, 0x0, @mcast2, 0x8}, @in={0x2, 0x4e21, @empty}, @in6={0xa, 0x4e23, 0x68d9, @empty, 0x80000001}, @in={0x2, 0x4e21, @rand_addr=0x5}, @in6={0xa, 0x4e24, 0x1, @dev={0xfe, 0x80, [], 0x1f}, 0xffffffffffffff81}, @in6={0xa, 0x4e24, 0xe396, @dev={0xfe, 0x80, [], 0xa}, 0x8}, @in6={0xa, 0x4e20, 0xa49, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x25}}, 0x1}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}], 0xf4) [ 3422.201891][T25843] binder_alloc: 25561: binder_alloc_buf failed to map pages in userspace, no vma 06:15:04 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000301ff08004f4944f9128fbda33d88c000001018ddbe090e25bd5db0961a318600840f5c0ec3d501abb1e8eab8daa168750003641ca33b7254f71e4efd18ccbf72ab8f201d0465f4aeae94f35d304a8fe7324dce61c5c8c1e2a1e7dc822f574879e27aa4fd16058e5cb7d8bc18ce8940b9cc17ff3753b0aaa824f1617a49024e9202b06b7aa35baedf440ecfbcd08ed64e9c0642813e192952f0f6d7900469f8bfd8ef2bdf62a37b82b8cbbba5e1829bd12b2b8d0d29cb586995e352ade12d81a36363714444dfdfda472c45959bbec2c51b481393d463b750e9c0eb0244fbbe333424814a21382e552b8d9d713c1302e1973470a6ac80e5dd9485288a581f68aa3f586ec617abcb0286c8340d94cb70a652dc"], 0x14}}, 0x0) sched_yield() [ 3422.279357][T25843] binder: 25798:25843 transaction failed 29189/-3, size 0-12288 line 3147 [ 3422.312659][T25902] binder_alloc: 25901: binder_alloc_buf failed to map page at 20002000 in userspace 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4c00}) [ 3422.324709][T25887] binder: BINDER_SET_CONTEXT_MGR already set [ 3422.346339][T25887] binder: 25885:25887 ioctl 40046207 0 returned -16 [ 3422.356223][T25902] binder: 25901:25902 transaction failed 29201/-12, size 0-12288 line 3147 [ 3422.369835][T25887] binder_alloc: 25901: binder_alloc_buf failed to map page at 20002000 in userspace [ 3422.381063][T25887] binder: 25885:25887 transaction failed 29201/-12, size 0-12288 line 3147 06:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0x9effffff00000000}, 0x0) 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6800}) 06:15:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000002000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYBLOB="00eb70c5153d844f63a4197e391aecd762de6f9cf6000000000000000000000000acb020bec0b75d83d85bcbbe0170fa0447b4becd2121a23aa0ee0c9d775c0abc4a623188d861e4d4f3f0f9106a9412c3a8506b750e7a024da99012c9cfa790f4cee3f50ea65cd078d614ab9c226782a10a1e6fc93b458ca942101e53479e26b56896dc5a1a5708eb2615688b0d3ab7f5c9861ff9e87c97676a57f941389f1369e90b1c98d4b132089fab3f277673b2"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:05 executing program 0: openat$capi20(0xffffffffffffff9c, &(0x7f0000000240)='/dev/capi20\x00', 0xe5d55f82676e0dc7, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYPTR], 0x4}}, 0x0) r1 = accept4(r0, &(0x7f00000000c0)=@nfc_llcp, &(0x7f0000000140)=0x80, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f00000001c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x3, &(0x7f0000000180)=[{}], 0x0, [{}, {}, {}]}, 0x80) 06:15:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6c00}) 06:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xaf58000000000000}, 0x0) [ 3422.633937][T26474] binder_alloc: 26472: binder_alloc_buf failed to map page at 20002000 in userspace [ 3422.651333][T26475] binder: BINDER_SET_CONTEXT_MGR already set [ 3422.672160][T26475] binder: 26473:26475 ioctl 40046207 0 returned -16 [ 3422.683376][T26474] binder: 26472:26474 transaction failed 29201/-12, size 0-12288 line 3147 [ 3422.712682][T26553] binder_alloc: 26472: binder_alloc_buf failed to map page at 20002000 in userspace [ 3422.727022][T26553] binder: 26536:26553 transaction failed 29201/-12, size 0-12288 line 3147 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7400}) 06:15:05 executing program 0: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r0, 0x4040ae72, &(0x7f00000000c0)={0x7, 0xfffffffffffffe00, 0x4, 0x4, 0x2}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000080)={0x0, 0x1bf, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[], 0x372}}, 0x480c1) 06:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000140)='\x00'}, 0x30) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc004240a, &(0x7f0000000200)={0x3, 0x0, [0x0, 0x0, 0x0]}) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7a00}) 06:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xdefe000000000000}, 0x0) 06:15:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x402) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, &(0x7f0000000300)}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000140)={&(0x7f0000000080)=[0x7, 0x6], 0x2, 0x0, 0x200, 0x8000, 0x1, 0x6, {0xadf5, 0x4, 0x3, 0x0, 0x9, 0x9, 0x4, 0x765, 0x2, 0x7fffffff, 0x100000001, 0x5, 0x3, 0xffffffffffffff0d, "a15ed6f9ecc5c68b9820cb3fd2edd26cc1dc61f487020882c3e290c5852b6fc8"}}) 06:15:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000003000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:05 executing program 0: socketpair(0x2, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x6020}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r1, 0x404, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4048840) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000000301ff0000000000000045a1c2000000000000"], 0x14}}, 0x0) 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xbf00}) 06:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x10000) ioctl$VIDIOC_ENUM_FREQ_BANDS(r2, 0xc0405665, &(0x7f0000000140)={0x4000000080000, 0x6, 0xf189b2b, 0x800, 0xfffffffffffff5a1, 0x1, 0x4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="00500000eeff0000100e0484b43d828b329c5fd51d231e45d2036861e775953b5691ebcf2438a0a67eb3272d9a309977568f5030136fe982f67d2d40f03b4f58f60e046f3c2bc59ad0f4c026b88ae114395dbae86d9d8f378d43238c34"]], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfd00}) 06:15:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x22100, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000200)={0x0, 0x6, 0x0, 0x5af, 0x0, 0x6, 0x2, 0x8, {0x0, @in6={{0xa, 0x4e24, 0x3, @mcast2, 0xfffffffffffff801}}, 0xff, 0x0, 0x3, 0x5, 0x800}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000180)={r3, 0x3}, &(0x7f00000002c0)=0x8) 06:15:05 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) [ 3423.199178][T27427] binder_alloc: 27410: binder_alloc_buf, no vma [ 3423.238895][T27464] binder: BINDER_SET_CONTEXT_MGR already set 06:15:05 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) [ 3423.250896][T27459] binder_alloc: 27410: binder_alloc_buf, no vma [ 3423.258124][T27427] binder: 27410:27427 transaction failed 29189/-3, size 0-12288 line 3147 [ 3423.276139][T27459] binder: 27413:27459 transaction failed 29189/-3, size 0-12288 line 3147 [ 3423.290642][T27464] binder: 27462:27464 ioctl 40046207 0 returned -16 06:15:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1000000}) 06:15:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x3, 0x2) ioctl$VIDIOC_G_FREQUENCY(r2, 0xc02c5638, &(0x7f0000000180)={0x200, 0x7, 0x7fffffff}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000240)={0x103ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000001c0)={0x100000000, 0x4, 0x5, 0xfff, 0x7}, 0x14) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000090d1007bb6955fc200000000000000000000000000000000000000000000000000000030000000000000", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="6800000000000000caa745807d4ac48913c904e8e96d0bbfef1c33279bb3026913"]], 0x1fd, 0x0, &(0x7f0000000300)}) ioctl$VIDIOC_G_FREQUENCY(r2, 0xc02c5638, &(0x7f0000000200)={0xa2, 0x5, 0xffffffff}) 06:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) 06:15:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2000000}) [ 3423.528351][T27880] binder_alloc: 27869: binder_alloc_buf failed to map page at 20002000 in userspace 06:15:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000004000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r1, 0x40046432, &(0x7f0000000140)=0x9) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3000000}) 06:15:06 executing program 0: r0 = socket$inet6_sctp(0xa, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000240)=ANY=[@ANYPTR, @ANYRES32=r0], &(0x7f0000000040)=0x2) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x400, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000180)=[@in6={0xa, 0x4e24, 0xa479, @ipv4={[], [], @empty}, 0x1}, @in6={0xa, 0x4e21, 0xfffffffffffffffb, @rand_addr="cbc3a9e9b54106ded90052512ff15dde", 0x8}], 0x38) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x80000001}, &(0x7f0000000140)=0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4c6212a33d88c000001418dd"], 0x14}}, 0x0) 06:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xffffffff00000000}, 0x0) 06:15:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4000000}) 06:15:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x400802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x6c000, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r2, 0x8250aea6, &(0x7f0000000140)=""/111) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3423.681094][T28140] binder: BINDER_SET_CONTEXT_MGR already set [ 3423.707432][T28145] binder_alloc: 27869: binder_alloc_buf failed to map pages in userspace, no vma [ 3423.717495][T28140] binder: 28138:28140 ioctl 40046207 0 returned -16 06:15:06 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}, 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0) 06:15:06 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_AUDIO(r0, 0x40345622, &(0x7f00000000c0)={0x100, "e87337db7ab9590200f7c80ef80000000000000000000000000000000100", 0x4, 0x1}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x6f, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0063404000de0000000000ea0000000000000000000000000000008000220000eddd000000000000000000000030000000000000b5ac67f85947b2a56cba90e7f1cf634b56cbb12a978a0ccbfcdca3cc529aaadb56dd295448ed82e83a382ffcb07aa7958a9b37096b93e89bbccf9bbe89875be61e7b82a00139b48dbe366efadf08f62c3745313339f8685010b003f558e8e4df5f910e9b0669cbbea09f46b5ef6b6b4dd52b399b4a73e5b59be0882f076a9aa14bc94e7e729956d47ef3afb9cfe964924c9b21ca43c6a79a3f962bd480a78a76885de468ffa2bab96211f909000000e67300a90fb7d2add0ddd22bd46b04470d1df52af493da88717fe8a61a2475dc9d04eb7abb530f8dc19021c3dcbce5dbc50d2b87734a6fae667735cb2e2fe9e2b38cae6fd82d1f144ce43d3e5dcb3301fc93fc89d7595fae08f7017d20f7d24233eb03be79b6c8c91b83a26a0cffff34c4aa3c3f91b925a79aba1ab11d5e1e38", @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x5e, 0x0, &(0x7f0000000200)="87f3da788a95ac06dc4c0e0d039ec59819487fe316d5ba6abc0cbe844258ba110e1d4001d759ea3edc28ef5fe7f7f769f8b5fd9134259ae3977112f414eac31919e7bf93f5b1c3fa48174f2bb407f1a7faf85f9c4f783838fa41a2225465"}) 06:15:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5000000}) 06:15:06 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xf, 0x80000, 0xfffffffffffff801) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000000301ff07008fbda33d88c000001018dd"], 0x14}}, 0x0) 06:15:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0xfffffffffffffffa, 0x204000) setsockopt$inet6_tcp_buf(r1, 0x6, 0x21, &(0x7f0000000200)="6fec33eadc63d926a1a01cef51e3dcf2bdf1728915d6615d0000ea78c625e6df5ee8066ff2a896b1530d83b9e6b24a49a8320d260db7ea8a076677", 0x3b) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f0000000180)=""/86) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="0000627aeba387e67137394f60000000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3423.942168][T28629] binder: 28628:28629 got transaction to invalid handle 06:15:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000005000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) 06:15:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6000000}) [ 3424.051055][T28692] ------------[ cut here ]------------ [ 3424.056568][T28692] kernel BUG at drivers/android/binder_alloc.c:1141! [ 3424.101446][T28692] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 3424.107690][T28692] CPU: 0 PID: 28692 Comm: syz-executor.4 Not tainted 5.1.0-rc2+ #40 [ 3424.115674][T28692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3424.125759][T28692] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 3424.132271][T28692] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 3424.151882][T28692] RSP: 0018:ffff8880585176d8 EFLAGS: 00010216 [ 3424.157956][T28692] RAX: 0000000000040000 RBX: 0000000020001000 RCX: ffffc9000e647000 [ 3424.165930][T28692] RDX: 00000000000004df RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 3424.166662][T28920] binder_alloc: 28628: binder_alloc_buf size 12288 failed, no address space [ 3424.173909][T28692] RBP: ffff888058517758 R08: ffff88805e838280 R09: 0000000000000028 [ 3424.173917][T28692] R10: ffffed100b0a2f32 R11: ffff888058517997 R12: 0000000000002fd8 06:15:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x200000006000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x1fd, 0x0, &(0x7f0000000300)}) [ 3424.173924][T28692] R13: 0000000000000028 R14: e687a3eb7a620000 R15: 0000000000000000 [ 3424.173935][T28692] FS: 0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:00000000f5d12b40 [ 3424.173943][T28692] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 3424.173960][T28692] CR2: 0000000008460465 CR3: 000000009a0a1000 CR4: 00000000001406f0 [ 3424.182884][T28920] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) [ 3424.190632][T28692] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 [ 3424.190639][T28692] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 3424.190644][T28692] Call Trace: [ 3424.190674][T28692] ? memcpy+0x46/0x50 [ 3424.190692][T28692] binder_alloc_copy_from_buffer+0x37/0x42 [ 3424.190708][T28692] binder_get_object+0xc3/0x200 [ 3424.190733][T28692] binder_transaction+0x2b4a/0x6690 [ 3424.255181][ T3876] kobject: 'loop5' (00000000a2dea5dc): kobject_uevent_env [ 3424.255813][T28692] ? binder_thread_read+0x3d50/0x3d50 [ 3424.255829][T28692] ? __lock_acquire+0x548/0x3fb0 [ 3424.255853][T28692] ? __might_fault+0x12b/0x1e0 06:15:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7000000}) 06:15:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x8000000}) [ 3424.259159][ T3876] kobject: 'loop5' (00000000a2dea5dc): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 3424.263111][T28692] ? lock_downgrade+0x880/0x880 [ 3424.319710][T28692] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3424.325964][T28692] ? _copy_from_user+0xdd/0x150 [ 3424.330824][T28692] binder_thread_write+0x64a/0x2820 [ 3424.336039][T28692] ? binder_transaction+0x6690/0x6690 [ 3424.341417][T28692] ? __might_fault+0x12b/0x1e0 [ 3424.346204][T28692] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 06:15:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xa000000}) 06:15:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x21000000}) [ 3424.352466][T28692] ? _copy_from_user+0xdd/0x150 [ 3424.357330][T28692] binder_ioctl+0x1033/0x183b [ 3424.362024][T28692] ? binder_thread_write+0x2820/0x2820 [ 3424.367498][T28692] ? __fget+0x381/0x550 [ 3424.371677][T28692] ? ksys_dup3+0x3e0/0x3e0 [ 3424.376105][T28692] ? get_old_timespec32+0x200/0x200 [ 3424.381317][T28692] ? tomoyo_file_ioctl+0x23/0x30 [ 3424.386272][T28692] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3424.392894][T28692] ? security_file_ioctl+0x93/0xc0 [ 3424.398108][T28692] ? binder_thread_write+0x2820/0x2820 [ 3424.403614][T28692] __ia32_compat_sys_ioctl+0x197/0x620 [ 3424.409112][T28692] do_fast_syscall_32+0x281/0xc98 [ 3424.414160][T28692] entry_SYSENTER_compat+0x70/0x7f [ 3424.419276][T28692] RIP: 0023:0xf7f16869 [ 3424.423355][T28692] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 3424.436767][T29132] binder_alloc: 28628: binder_alloc_buf size 12288 failed, no address space [ 3424.443053][T28692] RSP: 002b:00000000f5d120cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 3424.443068][T28692] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0306201 [ 3424.443075][T28692] RDX: 0000000020000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 3424.443092][T28692] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3424.451958][T29132] binder_alloc: allocated: 12288 (num: 1 largest: 12288), free: 0 (num: 0 largest: 0) [ 3424.460178][T28692] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 06:15:07 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000015c0)={'sit0\x00\x00\x00\x00\x00\x00\b\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000012000)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}]}, 0xff0e}}, 0x2) 06:15:07 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000004c0)={{0x4000000080}, 'port0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x42000000}) 06:15:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) link(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='./file1/file0\x00') rmdir(&(0x7f0000000000)='./file1\x00') openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./c\t\x00f9te>/E\xcf,\xc0\x8d\xc0\x16\xa3oup/syz1\x00', 0x200002, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x6, 0x2000000000440100) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00', @ANYPTR64=&(0x7f0000000140)=ANY=[], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYBLOB="0000060000000000"]], 0x1fd, 0x0, &(0x7f0000000300)}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r2, 0x84, 0x1c, &(0x7f0000000140), &(0x7f0000000180)=0x4) 06:15:07 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140052ad1bdff1000003091f0800b704a33d88c000"], 0x14}}, 0x0) [ 3424.460186][T28692] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3424.460200][T28692] Modules linked in: [ 3424.514895][ T3876] kobject: 'loop3' (00000000f9f49c57): kobject_uevent_env [ 3424.523090][T28692] ---[ end trace b2bc98d79596e866 ]--- [ 3424.531201][T28692] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 3424.540400][ T3876] kobject: 'loop3' (00000000f9f49c57): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 3424.566479][ T3876] kobject: 'loop2' (0000000008eb1860): kobject_uevent_env [ 3424.573660][ T3876] kobject: 'loop2' (0000000008eb1860): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 3424.584171][T28692] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 3424.634449][T28692] RSP: 0018:ffff8880585176d8 EFLAGS: 00010216 [ 3424.643119][T28692] RAX: 0000000000040000 RBX: 0000000020001000 RCX: ffffc9000e647000 [ 3424.653244][T28692] RDX: 00000000000004df RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 3424.663110][T28692] RBP: ffff888058517758 R08: ffff88805e838280 R09: 0000000000000028 [ 3424.671712][ T3876] kobject: 'loop3' (00000000f9f49c57): kobject_uevent_env [ 3424.674103][T28692] R10: ffffed100b0a2f32 R11: ffff888058517997 R12: 0000000000002fd8 [ 3424.686627][ T3876] kobject: 'loop3' (00000000f9f49c57): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 3424.690259][T28692] R13: 0000000000000028 R14: e687a3eb7a620000 R15: 0000000000000000 [ 3424.708868][T28692] FS: 0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:00000000f5d12b40 [ 3424.718716][T28692] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 3424.729275][T28692] CR2: 000000002020007f CR3: 000000009a0a1000 CR4: 00000000001406f0 [ 3424.738050][T28692] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 [ 3424.749254][T28692] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 3424.758129][T28692] Kernel panic - not syncing: Fatal exception [ 3424.765016][T28692] Kernel Offset: disabled [ 3424.770203][T28692] Rebooting in 86400 seconds..