setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:17 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc5310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:17 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:17 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:17 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000180)=0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) kcmp(r3, r4, 0x3, r2, r1) connect$rose(r2, &(0x7f00000002c0)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @bcast}, 0xfffffffffffffd49) 03:35:17 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 483.962371][T15054] binder_alloc: binder_alloc_mmap_handler: 15042 20ff9000-20ffd000 already mapped failed -16 [ 483.994780][T15043] binder: BINDER_SET_CONTEXT_MGR already set [ 484.008978][T15043] binder: 15042:15043 ioctl 40046207 0 returned -16 [ 484.026188][T15054] binder_alloc: 15042: binder_alloc_buf, no vma [ 484.040594][ T7855] binder: release 15042:15054 transaction 335 out, still active [ 484.049515][T15054] binder_transaction: 1 callbacks suppressed 03:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x4001, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2001f, r1, 0x0) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x400000, 0x0) getsockname$packet(r2, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000480)={@empty, 0x2d, r3}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x1) 03:35:17 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc6310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 484.049533][T15054] binder: 15042:15054 transaction failed 29189/-3, size 0-0 line 3147 [ 484.064232][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 484.070721][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 484.077965][ T7855] binder: release 15042:15043 transaction 335 in, still active [ 484.086122][ T7855] binder: send failed reply for transaction 335, target dead [ 484.156983][T15067] binder: 15065:15067 unknown command 0 [ 484.162858][T15067] binder: 15065:15067 ioctl c0306201 20000140 returned -22 [ 484.177414][T15067] binder_alloc: 15065: binder_alloc_buf, no vma [ 484.183998][T15067] binder: 15065:15067 transaction failed 29189/-3, size 0-0 line 3147 [ 484.197138][T15072] binder: BINDER_SET_CONTEXT_MGR already set 03:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 484.210249][T15073] binder: 15065:15073 unknown command 0 [ 484.216260][T15073] binder: 15065:15073 ioctl c0306201 20000140 returned -22 [ 484.226323][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 484.234089][T15072] binder: 15065:15072 ioctl 40046207 0 returned -16 03:35:17 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc7310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 484.350137][T15081] binder_alloc: binder_alloc_mmap_handler: 15076 20ff9000-20ffd000 already mapped failed -16 [ 484.364475][T15077] binder: BINDER_SET_CONTEXT_MGR already set [ 484.381831][ T7855] binder: release 15076:15081 transaction 340 out, still active [ 484.390446][T15077] binder: 15076:15077 ioctl 40046207 0 returned -16 03:35:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffff8, 0x0) ioctl$IMADDTIMER(r2, 0x80044940, &(0x7f0000000280)=0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 484.397224][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 484.403094][ T7855] binder: release 15076:15077 transaction 340 in, still active [ 484.424930][ T7855] binder: send failed reply for transaction 340, target dead 03:35:17 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc8310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 484.511232][T15091] binder_alloc: binder_alloc_mmap_handler: 15085 20ff9000-20ffd000 already mapped failed -16 [ 484.537819][ T7855] binder: release 15085:15091 transaction 342 out, still active [ 484.548362][ T7855] binder: undelivered TRANSACTION_COMPLETE 03:35:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000300)='/dev/midi#\x00', 0x0, 0x42000) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0x40a85323, &(0x7f0000000340)={{0x0, 0x7fffffff}, 'port0\x00', 0x4, 0x1, 0x200, 0x2, 0x1, 0x0, 0x1ccb7fcd, 0x0, 0x2, 0x1000}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x80000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000400)=0x4bfc, 0x4) ioctl$sock_inet_udp_SIOCOUTQ(r3, 0x5411, &(0x7f00000000c0)) r4 = dup(r1) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000180)=@assoc_id=0x0, &(0x7f00000001c0)=0x4) ioctl$UI_ABS_SETUP(r4, 0x401c5504, &(0x7f0000000440)={0x9, {0x7fff, 0x7ba6, 0x4, 0x8, 0x1, 0x64}}) getsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000280)={r5, 0x135}, &(0x7f00000002c0)=0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 484.569691][ T7855] binder: release 15085:15086 transaction 342 in, still active [ 484.605806][ T7855] binder: send failed reply for transaction 342, target dead [ 484.627793][T15096] binder: 15095:15096 ioctl 401c5504 20000440 returned -22 [ 484.636389][T15096] binder: 15095:15096 ioctl c0306201 20000140 returned -11 [ 484.644705][T15096] binder: 15095:15096 got transaction with unaligned buffers size, 309 [ 484.654872][T15096] binder: 15095:15096 transaction failed 29201/-22, size 0-0 line 3210 03:35:18 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 484.678512][T15098] binder_alloc: binder_alloc_mmap_handler: 15095 20ff9000-20ffd000 already mapped failed -16 03:35:18 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:18 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:18 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc9310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 484.755707][T15096] binder: BINDER_SET_CONTEXT_MGR already set [ 484.791968][T15098] binder: 15095:15098 ioctl 401c5504 20000440 returned -22 [ 484.802588][T15096] binder: 15095:15096 ioctl 40046207 0 returned -16 [ 484.817580][T15110] binder_alloc: 15095: binder_alloc_buf, no vma [ 484.824101][T15110] binder: 15095:15110 transaction failed 29189/-3, size 0-0 line 3147 [ 484.843626][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 484.851316][ T5] binder: undelivered TRANSACTION_ERROR: 29189 03:35:20 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xfffffffffffffffe) write(r1, &(0x7f0000000280)="f8624174ae76f344622081027cabdee0c00cc850d1a7d91546d814da69645688871becdec2d48db2694b11ddec9d1075762c15878e9c1abea192a83327dbdd71e8a5c6eae829c5660e879ac59c3582d609dd189656c5b9db97e2389a46fae91a80c0580748ee7ca0167ea3657eb5ae3ac2333a727d3373529c0f085b756a0da2fb4d6f41bb149ef59a190258ae545599186ab498015fcd45765460c721387181251b2a989ab9eff6f6f208045fc4ab3b65482187448e5d10e62a0570012ec40029a846f0e29334f65105b99684980a737a1c07812820ca751b7d3bded821cf39397031d96e22725bd2675db64ec0", 0xee) syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x1, 0x2) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:20 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xca310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:20 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:20 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:20 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x7fffffff, 0x20000) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000180)={&(0x7f0000000080)='./file0\x00', r2}, 0x10) r3 = mmap$binder(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000000, 0x8013, r2, 0x0) r4 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001540)={0x114, 0x0, &(0x7f0000000400)=[@free_buffer={0x40086303, r3}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x28, 0x10, &(0x7f0000000280)=[@ptr={0x70742a85, 0x0, &(0x7f00000001c0), 0x1, 0x2, 0x29}], &(0x7f00000002c0)=[0x18, 0x48]}, 0x2}}, @register_looper, @transaction={0x40406300, {0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, &(0x7f0000000300), &(0x7f0000000340)=[0x40, 0x0, 0x20, 0x38, 0x38, 0x38, 0x48]}}, @request_death={0x400c630e, 0x4}, @acquire_done={0x40106309, r4, 0x4}, @increfs, @reply={0x40406301, {0x1, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000380), &(0x7f00000003c0)=[0x78, 0x20, 0x0, 0x48, 0x60]}}, @exit_looper], 0x1000, 0x0, &(0x7f0000000540)="0867b4f62830d4939be277a48e07a0f65f88d751fe9014f95020d4a74945c5e300e6213f4103cce1ed82bc698b4a85b9de9a15fa5758f4f0a3ad08241fb158c5541541b07ac6b2fc429ac440abfb020f0158740b45a6eaff5630262cc5aa57ca32ffcf7994a5381926cabec1b66604e4f57c3ed188c6cee17cd6ab8b055023b385f6ec19d0e38af62ea9170983407e4790fc68d6f231e9090ee66ee6a49f5e4687b94f30b57c4802158defd41da5bb36fd86f29c69b1a26f364730107c848b8e0d267aef24345355d9bbf4e59d32921586192eecfe7b9b5b9f89ede46179bd3c11b143e89726bee09e4ddf1b1ecdb33ece4dc3b78a6d687c6f385bdba0ae5998a777e5e14298ff3c0a69ff757a420de27f702c2b97d3985da680196e57dcd902ba7205bd13b3f1d27ce9c364a3e6532405b4dd211f1eccd7efaedf8c9b391c031220e38bd06c2b572c7197464df0ef843de1c9808ba5f6df0e00fad7c1b36328a5dea88e2cfb94ea51fbfdc013c8ea3023226f2b6c614ce1c1b4eba3efe7bc840d1012c237c60030d8c309bfd2552e0cdeaee315b10e8492123b2d372e215932f5b159e5fc8c799295750ee3bc98c980fd69f72faff30b30883cfd5aefe71a781cc7c6caeeaa18fa785ccecb85f4474e41b4782b06c9c6ee6487c9ca5643c7410f1a514a3712ef68c82d7f38ee0de70cd8a965606354c5f76eab494d65d4a51e06d21dbb6a04acbea47b541bbbf35737f00f588bd8888b902b7f0503448f9f7fc97a8d1592fc211c91f55df92021736d3e21e10ab17d36c276b92f6f48a87b31b6e2d0281740bc9dd515ffce59ace3ff99eaeb878b535131fd06bac3ff9920f7ecf1d7f1b0603991c186a588df61aac2b07c2fa71f40f4e50a25a24705d8abea164462b12f384339647d1e77ee74a09a1f220a6a1a2bb6a3dde0e829712b1b82221f5e5ddc630ac72cd77bd83230315b8b6abd9e8be78bd0c2bca1d48d1363fb7fcde28cd4e80d31fa47fdb4c0f4cb10f45a984f91bd8b94d124e7d41ba8a7cd452dcd490e91bff4977c904d0ad48a573d77f1447c211bfd4e361323d84d536ec527d91bdcac57da855d7f66f2210aa3a5f96f876c0d74e306d58bd1a04682645d6bff7dbf2bdd644c2065a335d6a52598f8678c912d57c0a57edabe73de5e841f810979316f5ed41056d44e3dfbe7497e79995b9580bc2cd530f0a07db2448b767ecc2e208a905c9bfd7c34060d7c9f68191c6fc548bde012daf4fd64b8646535b53a425a101371cfcd8a462d59fcb09ff46681d0fc1032e74309bab00a78b3bb02aedbd74683e3147426361960af5864eb9fe903d24319c727af3d8c9559d63933f9e99920d1ddccc07cb49c7844871eeff94eed20c9cee5e6eaed9b7d78d821071dd01591ee6358dae3ba2a4ab4867b28437f589323d22fc5b3be6e64078008965cedd0f6b3b0725d1acfbca1cd51d7bd57890fe7dce01683b86f4d0d99276b6bc45e318407ec3fd5a010c6e895c318d6960646851942eb15eabbe6fc17b440ea429f9e80961fed24b7c8cb5aea362d84e16dcef667cc7f5aa43a22e319ee1c9c34035f423f61a82a4cab94d4ea359bcf0aa4b6ab1bbbdca101c1c4a58d461af62faf6be7654fd56fd4151ed826a28617c0ebc090d38a2afe3dd2efa98ab2936f1d7ec28d99e547e7116266940a119da789392f287881eace3826cf3a589c4a3cdd50493d64049f6cb08e9f3758095369db18298e06db036e07828d47625bcb80a12987305a2d4b045dd9623c1898fb2b7238fccb34cb44400355e545cdd7a5da861fe2625b50aaab9de6ef9fbf92ebc635e8d45bc7766d1431a8e3209d4d1fba492b711c18d72714377863191e8e8204bb551cbd19d81026a9bcb96db5daf1e61fa5980679b1be7b62f5907153552c322ebfc0b97ee456014890151fc8b05e07a0be1a26d1ec2affc0975c2d86bfe78c23a110d325453633fbecf2163847a09b4cc9d0940f67db414436976acb253e8182c0ddc3a70acdb02d47f37c5c45249090f15b1e65e3e0ff4d7acdd6f2092c2ccbb3fe7eba6e1538888e15aa1f80906ad5a9c4bf85137f66033e344bd9c1b666aba399071d77df936a1547039c8ebf8dac35283dffd5a88db535dc8af80250310272259763427155be0ee4dbefd39aa907497e80af49406b761db5959e31c245c38af2267b237759e82a7c4876f9c6e4afce09a5389336e9c8cd2028a7bb3d1809364b3beafebe1202d2f6dcf13f969fd4d0e60a2171b3f4e1d4076ef4310234657838bbd9a976713ad15997f25cec891ffeb5746af14271d10432e371a06db590afa6f707e870e26f0ea5f554f12babea552518c0651ad744c1d487da511d36a2924eead6fa7dc6fd2a33af1f0c0f8120204173e3952f8578f9a2deb28aca06fe5ee8c2ebe53d85396f5de7c50fa561302af53de0629862e41c62ffdfbb509b0e8c55df7b61b48027c7e4c192f3b7e515178afe56f3e6b4a988ed6da622a57f786cc6fcc729d4e65fa4de663c8b726eafc4ffbe7cab2982b824a2eeed8d7b24e33772f7019918789246570e32e86da0960dc7562a1b9027e88761d452c963a1fcd95d0f803b013e6c55158384733cdf429067a56936031cec640e0e74ec6a08d7d09c1bd565b2b649c61ad4459a0b885348da940c8354145729711929dd222171f4597cebd7057319b425cf31905bb7e002cbbfce2efda75ad327c384d6f5e60106123ef1d18bc493fd2f8a61cb373ddc3a99c89b9476e0bb8e9c87054b3e3e40e1dabf58399777158e196b8f11926ac41884baaf15e5fe1c959ce4a6ac9bc90241fe1b831696934ed6339b477f569c64df20644657a3f9b6bf31b0e7d07539a5f2da320924a314fb9d044ab2cab33671d48b2be0a82821602c7bd17069b83d21ae43b92c92e3b111cdcec16f7ef751cea7f7f70b80001bb7c69230cfe84f19432f15e5ce0aaefa3c2f8bfd6311560fd625165de429c9b77348df0d86d4a43e516728cae7da8bc12ad03ffee20f96725256514c6515d029d4ff5cb80608dfcf12466e56b783dc3c3ed371e713efc1d2f07b99920f22c1cd403addcc8b6ea965ed2c3db6be8d41ff7a51af19021a76cab7e81133b0a4c56c989b6b23bb64009db514f572711206b0b114258ee4f1d45e3cf65645b09aaa687c47718a0cfdc723196a0f8ba220f7540dc18bf1d6d158861e2859be809eeeda55225e0dec65b6f82fb3c9f65ec31da024ea6f50bcf751965ae666bdc738aa1c0e9e7cb7d47cd0b1955a9776101e2d6290be1341e016cae86817ec231cc5f4c8ce74cdae7cbf1906dd23867258c00028e29b88242486cd6530ce2d6bd8b4be58822a9c31200890cf7c9d21de87b80f285c51af1c99f84354025126a576115d43e5ccbe2c8b5d3479aac44e52e57d8e63702b0e8ea173a875dcda9d997147abc4c49fa8c3b07691beac4d8a1ace11602d2355bd613fc74debf655d2a7ecc1a92d63895f24056d234e9b5403e799635b0f33b36fb0bec7ed54e690a801f5c5265dd9232e4f6b071346529672411db50dc41ca117a21b67b4a825e52adeba9fc7522735840fc7ccb75a8d30664b900c6382d884adc0d924a29232c87c658bd5a4d82ec072759cfb35927735a6bef75fb0bfaa28090bc967e795c91914478bf61c49f82ca2b9ed7cdfcd296632703ab259439e010f142ed35b7de6fe87cdcafbb9b7e7144b70f599c073580b0037907cc9baf586744ffbd33f02a307c80286b0d97055d7231f8651356403460b523859c36e11b48e2daa83ae0221a1bb59d3e599452a025cdd76f08ceca5f1bf6ba32041e8f44f9d0bd5068667e3c3ab6e4397c9d37603634336e4059e521e1fba817882d3fea38741339bdf75a4eca069fd6a8d300f8f6b75b99d97ff9a54e75f85d20265314b0a413f2dd903c1ec298264df834efefa6ea311c4cca2d4639be86bfc9f42a3d74e862a3e966e429e6417ef5679fb1d43a86924d9c258a7283aed78918555ed544e5666715a7288ce7b5658a2c72d071cb21509908a00ffd9a5b767834a2a0a831d798b4602fdf58225b30e288cae66fd0ffb79e5cb8a31b0f5e691e79cdea257650868472f1a59bec9c86f3a99d758713e48cccc85d45c3b7ed920b3126a2e6919033551399d7bef6927182d2291e2de620aedc38a8c26a714131ad40d7ce1b22780644356bdbad35d98206279c3129181be1466d6020405a1322752c025252520fd3c793808f078c496ccdfbb679fbcd0139f68158939f33f85e68bcdfd5b1d1d0de9611373da37ee58a63197c605da0fbbb8d0eb86514c06f794c40da7a4bc5bad6a5eafc3f7a70a87a9142a03cb03fb53f34d8c32c24685fe7a4b66acae8cf46630112da8e9502a30b39fef5f791ca4ba5d7ab8ac08fb10980c6666e3ce1fbfcd7dbe38b0e629b760562ed5715f8e93e54542a18f2e5ccdb5c071aa643313bde8201c77fe53ad1680bc35c0cb9e14cd01039dd9a750ff7cc12720fa4300627d07b0b3614fee70820acf3dfc0a96d0230780141e6304ae5fa4d97170c093f2f391de4841708aae75de0fd48cf5902c231d1924b7aec9bb0aed15e91c6e4a86e07d9253687a0acd0727e201c215fd4944a74e72dd3c4ffbcbfcf08f4dcd1c2dea7b974e6a362bf54d126b80d1f700b8fb94fe764eb8659aa39279e8198b16a3e6e4c23e38cf49fcbb498f5d9883ab0800929270fd02e117618c002be728a653452fefd3c3311e63af8268087b753c1a02ad04c711c8fcd0b0b002b60421ab835de4e8377d7999317d747890b464dd3dc2d0914a600d138112235df6707949ad15bd23dcb1e32e9273bd0c396dc7a8db7ce2c2e2751f268d9b8e11418bad20ed6a33725e106175cb56d563ee4d0160b27886973ab461289327e98d1a67078db44aae4d821114e62a626ecc661fd7bea2ee6c76a9d37320809506c5acb22e4df5358b64493f106c92837927aec175e088cfad491727c4b588a727dbf46bf17e164d7af88810592bb922e329122130ac7f38d73f21da90de3f0867e779fcb2aa273860d85434098bc332c3f4f2ab2c1c9761fb4a98403dd5eb2fe29c4f82bea8cb053c0bca79ed7ba5ad2d6bbb9387e57766e497055dfd245de9960e3605d7935a27ec0f173becffeb2957e1997d0afcbb3e16b4d4becfc69f2912398537592039ea2d2f410d58b41e09bb3787f93c7c4501080bb00e7429b390ee0972e61c549d42adf4f08a5e7051bd4f2d01a104c9c5a7c8ae2a0b185c8663623bc9d21c211f80f544d0ea9b8bdff47e18638cc695209a8ff0ee123f70b4df22df77cb53ea7b8b0e89eea826203600513c857750431af638293df08f10e953ab9921f2c1d75d907f61ab66153537937664d7ff02c2a11dcd8e17ec14088b5dfc559ad3b4229f1016208192653e531d183b736e8cdfcd4452858f02fdc496b048ac1161f5b2fd14f34fb3124b0adc1311e45f648007ed7354aee907c8e946a29dbdb989b0b5d0f2fd32023b88f271705416df2d058f8fee26625dd0a186a27da33ffb2493ade2a00054eda408cb81e9b870d108e26121cb7c9e2d43ef6f15aa09e71fb0a08fc174f1dbcfe12cd7d936f9f684e72337574b467506b8872f2001bf0532224c8827a990002ba4a44adafadbf2f02eb059e4f01240a5ddfe1c9d02517489dcd574abdebe6ba2d240d2e371eb5c4d3f742f675e4df1fe0dceb4bbc51292c733973dae4e6997399f665a67bfb699e72352744fe427ba160c8ea95d202191ccdf8db60c506b50a0"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\f\x00\x00\r'], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 487.083883][T15132] binder: 15122:15132 transaction failed 29189/-22, size 0-0 line 2994 [ 487.109416][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 487.182668][T15145] binder: 15143:15145 unknown command 218103820 [ 487.198421][T15145] binder: 15143:15145 ioctl c0306201 20000140 returned -22 [ 487.208452][T15145] binder_alloc: 15143: binder_alloc_buf size 2305844933359042560 failed, no address space [ 487.221294][T15145] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) 03:35:20 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcb310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 487.231995][T15145] binder: 15143:15145 transaction failed 29201/-28, size 0-0 line 3147 [ 487.248359][T15149] binder_alloc: binder_alloc_mmap_handler: 15143 20ff9000-20ffd000 already mapped failed -16 [ 487.259647][T15149] binder: BINDER_SET_CONTEXT_MGR already set [ 487.266295][T15149] binder: 15143:15149 ioctl 40046207 0 returned -16 [ 487.273266][T15145] binder: 15143:15145 unknown command 218103820 03:35:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100), 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = semget$private(0x0, 0x3, 0x400) semctl$GETALL(r2, 0x0, 0xd, &(0x7f0000000080)=""/143) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x1, 0x0) ioctl$SG_GET_TIMEOUT(r3, 0x2202, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 487.280428][T15149] binder_alloc: 15143: binder_alloc_buf, no vma [ 487.289573][T15145] binder: 15143:15145 ioctl c0306201 20000140 returned -22 [ 487.298494][T15149] binder: 15143:15149 transaction failed 29189/-3, size 0-0 line 3147 [ 487.307453][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 487.314572][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:35:20 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcc310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcd310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xce310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 488.167066][T15158] binder_alloc: binder_alloc_mmap_handler: 15155 20ff9000-20ffd000 already mapped failed -16 [ 488.177535][T15158] binder: BINDER_SET_CONTEXT_MGR already set [ 488.183632][T15158] binder: 15155:15158 ioctl 40046207 0 returned -16 [ 488.184390][ T7855] binder: release 15155:15158 transaction 351 out, still active [ 488.205830][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 488.211981][ T7855] binder: send failed reply for transaction 351, target dead 03:35:23 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:23 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcf310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:23 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:23 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:23 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x1, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)={[{0x2b, 'io'}, {0x2b, 'memory'}, {0x0, 'rdma'}, {0x2d, 'memory'}]}, 0x1a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 490.182046][T15196] binder_alloc: binder_alloc_mmap_handler: 15183 20ffb000-20fff000 already mapped failed -16 [ 490.203944][T15186] binder: BINDER_SET_CONTEXT_MGR already set [ 490.213363][T15186] binder: 15183:15186 ioctl 40046207 0 returned -16 [ 490.228490][T15196] binder_alloc: 15183: binder_alloc_buf, no vma [ 490.228526][ T7855] binder: release 15183:15196 transaction 353 out, still active [ 490.249200][T15196] binder: 15183:15196 transaction failed 29189/-3, size 0-0 line 3147 [ 490.261205][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 490.272776][ T7855] binder: release 15183:15186 transaction 353 in, still active 03:35:23 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd0310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x141, 0x0, 0x0}) [ 490.283502][ T7855] binder: send failed reply for transaction 353, target dead [ 490.312461][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:35:23 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd1310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 490.396827][T15214] binder: 15209:15214 ioctl c0306201 20000200 returned -14 [ 490.412290][T15211] binder_alloc: binder_alloc_mmap_handler: 15209 20ff9000-20ffd000 already mapped failed -16 [ 490.424421][T15214] binder_alloc: 15209: binder_alloc_buf, no vma [ 490.431677][ T7855] binder: release 15209:15214 transaction 356 out, still active 03:35:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c6300011bbe941d431600cc068ac070452ffb5c7b7d5f430000b1f2b7725977e259823c1e07c63e5e64befa6a4373ec33612a494fe9441120534dfd911d26593ad96ec5581a76b3ea6e7a16fcf463d27b5d426993117115523e7b5d7d00710af31433ccfd5ce577fc93a252fbecbecafa806c034572f44529f7"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x200, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f0000000180)={0x2, 0x311, {0x56, 0x8e7f, 0x80000001, {0x200, 0x20}, {0x2, 0x6}, @const={0x9, {0xfff, 0x4, 0x6, 0x2}}}, {0x0, 0x3, 0xd1, {0x6, 0x3}, {0x2, 0x80000000}, @rumble={0xf2, 0x2}}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 490.443936][T15214] binder: 15209:15214 transaction failed 29189/-3, size 0-0 line 3147 [ 490.453249][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 490.454311][T15214] binder: 15209:15214 ioctl c0306201 20000200 returned -14 [ 490.466875][ T7855] binder: release 15209:15211 transaction 356 in, still active [ 490.474860][ T7855] binder: send failed reply for transaction 356, target dead [ 490.483464][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 490.529725][T15222] binder: 15221:15222 unknown command 16802572 [ 490.536203][T15222] binder: 15221:15222 ioctl c0306201 20000140 returned -22 [ 490.538781][T15223] binder_alloc: binder_alloc_mmap_handler: 15221 20ff9000-20ffd000 already mapped failed -16 [ 490.554480][T15222] binder: BINDER_SET_CONTEXT_MGR already set [ 490.560943][T15223] binder: 15221:15223 unknown command 16802572 [ 490.567399][T15222] binder: 15221:15222 ioctl 40046207 0 returned -16 03:35:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0xfffffffffffffc01, 0xabf85c7e3bca4fb7) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f00000000c0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:24 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd2310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 490.568228][T15223] binder: 15221:15223 ioctl c0306201 20000140 returned -22 [ 490.583570][ T7855] binder: release 15221:15222 transaction 359 out, still active [ 490.594066][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 490.594167][ T7855] binder: send failed reply for transaction 359, target dead [ 490.711266][T15231] binder_alloc: binder_alloc_mmap_handler: 15225 20ff9000-20ffd000 already mapped failed -16 [ 490.722555][T15226] binder: BINDER_SET_CONTEXT_MGR already set [ 490.729809][ T7855] binder: release 15225:15231 transaction 361 out, still active [ 490.738284][T15226] binder: 15225:15226 ioctl 40046207 0 returned -16 [ 490.745371][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 490.752642][ T7855] binder: release 15225:15226 transaction 361 in, still active [ 490.772839][ T7855] binder: send failed reply for transaction 361, target dead 03:35:26 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd3310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="113c6d9f678e400000"], 0x0, 0x0, 0x0}) 03:35:26 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:26 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:26 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:26 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 493.236155][T15254] binder: 15238:15254 unknown command -1620231151 [ 493.251333][T15254] binder: 15238:15254 ioctl c0306201 20000200 returned -22 03:35:26 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd4310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:26 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd5310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:27 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd6310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:27 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd7310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:27 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd8310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:27 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd9310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:27 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 493.971199][T15254] binder: BINDER_SET_CONTEXT_MGR already set [ 493.998616][T15254] binder: 15238:15254 ioctl 40046207 0 returned -16 03:35:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:27 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xda310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:27 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:27 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 494.211400][T15321] binder_alloc: binder_alloc_mmap_handler: 15313 20ff9000-20ffd000 already mapped failed -16 [ 494.259206][T15314] binder: BINDER_SET_CONTEXT_MGR already set [ 494.270829][T15314] binder: 15313:15314 ioctl 40046207 0 returned -16 [ 494.281650][T15321] binder_alloc: 15313: binder_alloc_buf, no vma [ 494.300897][T15321] binder: 15313:15321 transaction failed 29189/-3, size 0-0 line 3147 [ 494.316380][ T7855] binder: release 15313:15321 transaction 364 out, still active [ 494.324596][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 494.339726][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 494.350876][ T7855] binder: release 15313:15314 transaction 364 in, still active [ 494.360951][ T7855] binder: send failed reply for transaction 364, target dead 03:35:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:29 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdb310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x80, 0x0) setsockopt$inet_int(r2, 0x0, 0x17, &(0x7f0000000100)=0x8, 0x4) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x8c00, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0c630000d37c9424e2e4bb85f3af18189a8d911d3ba3ae8336bb2316ff360b1f88b935a593081ed51e7296ad9b12b5b8096bf5d814eb1de1c5c5bda763c90fc8c8d7026eed247302edf78009395e5be99e0ca41673b4e659f51298354e09ec078c98cb0381611030036bdfb9845b4a0d3c12e5a24c88b95152e399b7352eb3fa33ff3d1f8bb731c06192a104bf42f8df9260287582bac150b2324f951cbb11cd8c08c76856d18beadef6bc011e264ac09b5dc7855631ae46708cc55bc1e3002eb7173c4bae76e515038b926255881a6364db3522a28a0fc31bfce734fd06a03b835bd3cc66c1f58fabc9bf88b90d7dd3767d81f92997165273682b9174b469dabd6e8cf1ff5741daa20ceb2a9930620b2075860e81df6ee2131af99462ad98f4ad2e61d4ae6ed5e8590cd7c81a41"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="09020200"], 0x0, 0x0, 0x0}) ioctl$LOOP_SET_DIRECT_IO(r3, 0x4c08, 0x76) 03:35:29 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:29 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:29 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:29 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:29 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdc310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 496.390351][T15348] binder: 15331:15348 unknown command 131593 [ 496.409964][T15348] binder: 15331:15348 ioctl c0306201 20000200 returned -22 03:35:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdd310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xde000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xde310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdf310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe0310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe1310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 497.135816][T15397] binder_alloc: binder_alloc_mmap_handler: 15331 20ff9000-20ffd000 already mapped failed -16 [ 497.183579][T15348] binder: BINDER_SET_CONTEXT_MGR already set [ 497.194568][T15348] binder: 15331:15348 ioctl 40046207 0 returned -16 03:35:30 executing program 0: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) waitid(0x1, r0, &(0x7f0000000180), 0xc0000008, &(0x7f0000000280)) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:30 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:30 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 497.239328][T15403] binder: 15331:15403 unknown command 131593 [ 497.247902][T15403] binder: 15331:15403 ioctl c0306201 20000200 returned -22 [ 497.405676][T15416] binder_alloc: binder_alloc_mmap_handler: 15410 20ff9000-20ffd000 already mapped failed -16 [ 497.416843][T15412] binder: BINDER_SET_CONTEXT_MGR already set [ 497.423011][T15412] binder: 15410:15412 ioctl 40046207 0 returned -16 [ 497.423233][ T5] binder: release 15410:15416 transaction 368 out, still active [ 497.430272][T15416] binder_alloc: 15410: binder_alloc_buf, no vma [ 497.444421][T15416] binder: 15410:15416 transaction failed 29189/-3, size 0-0 line 3147 [ 497.448972][ T5] binder: undelivered TRANSACTION_COMPLETE [ 497.467304][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 497.480969][ T5] binder: release 15410:15412 transaction 368 in, still active [ 497.490533][ T5] binder: send failed reply for transaction 368, target dead 03:35:32 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:32 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe2310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$netlink(0x10, 0x3, 0x12) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in=@empty, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@local}}, &(0x7f00000000c0)=0xe8) sendmsg$nl_netfilter(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)={0x45c, 0xc, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {0xf, 0x0, 0x4}, [@nested={0x1c, 0x41, [@typed={0x8, 0x22, @fd=r1}, @generic="3a0d8925d00552cdddd39ce56230ce28"]}, @generic="731b73ae91325f10226516648f7e9d7873eac8436c7ebf37d88349adcdaa57c7089fffc916f08c10a0797c0305a3e4dfc5391c6ccad03ace69c1f9a5782ac81a3b2cb88b3cb5fa8cfe4d0bbb65a98bfc3682becee7bde9f37db63d86373dbf60a2f43d041b54165ca21919bf7d67d091a3c9f861acf267a8dc8094bdfdb004f84a84a542035ee33b6014949626af1a8336a5688b185caedabb86a87f6af6bf81b92b53eec2e039e82107b1487fbc9131b6e131cdedcc18c36965a550d9097d8c0bb2", @typed={0x4, 0x1}, @nested={0xa4, 0x2f, [@typed={0x8, 0x5, @ipv4=@multicast1}, @typed={0x14, 0x90, @str='/dev/binder#\x00'}, @generic="b6abde696e6fb682aff03c476ab33949e2c5f7671b8c0771f42893384329b5255a96463200e0cf6f75328ec839a161120564b37bfe7d2b98f499229bb3b86b4f57ba1ae2048733c71c91c793fb4d4869c698738a8ef8a426d74d0d45e743f2cf0f411a8ea358", @typed={0x8, 0xc, @ipv4=@remote}, @typed={0x4, 0x42}, @typed={0x8, 0x85, @fd=r1}, @typed={0x8, 0x31, @ipv4=@broadcast}]}, @typed={0x8, 0x76, @fd=r1}, @typed={0x8, 0x96, @uid=r3}, @generic="bcca3626b1fe262da10b03569b4d97dfca85e20df1d8a1f472f91b16c08926c079c7439e1a4a963c75a23c2d23def8685c12d5c1977eca869cc7a175fa95ca350c02e5db5012299cacfef1c4c76e4143f34e27d03e777977010c32", @nested={0x1c0, 0x4, [@typed={0x100, 0x3, @binary="f4875a13c7eaa6163bc4b863388030251b6b46805d072778ef247b184b98b455de0df53a036b7b1235d7f2b364ee5d83764fbe4490e1c682f973337075b56cdaced2b5350151ea7c5f01413961d2697b58345e516787da67274ff8785da10af55fdeb441738604c2f3da8d8585d47f9252ca02f2071c6a90b5bcb6e3b8fbcd36cf3a1c7343815a1971b22a6dbe56a716dd702468a136a067c9da753799430174e511a11a6ba627586df7f0b0f989034ade837b6aecd3a60d7d6965a75536c5f4a312951be1b7a59a105f3e0cfcf23985db1bb46fef28e0fd23d55150de8b6ddb9ad1cc54ef9ac1d2fdaf9048f43bcee4626f2d5aa8cff9fefb"}, @typed={0x8, 0x88, @fd=r1}, @typed={0xb4, 0x47, @binary="c2f71506027b140a9b1201473d76c852761be433baef42d013be26e6be3771fe6a01bc7763aab9ed2b03711f5c679d3840486eb7dad09753baab8cac76992bdbc6701405b516d1c15faeedc97bdbc2e56ee00bb05ccf9220ce0049ebac30c9f061b07ac0b9c8a64e2153bb6e89d2ce3d462bc65590ebab4241dec3019d26abcadd77eac9c0cc8d814a3946fc9747bc116301430f68d68a9eb888beef6975e54b172087855e093d0df1457801c12ae7f7"}]}, @generic="6e2b0bad4f945a9f28bafc613de5d5eb9c8a39452fcac63112d84f6a44ad73c1fe1c289908c7f4a3310d1a14b21fdac0ff6d60f3f05c1f948e5bced749bfbc0364a054c3e5ba8822c26fe9ff82b6b0ba6d6c61e8a94e9705f0edc97ff14740c29ba3ca1c890531dc3653405ba4a2894480dfb9e0079782ff6ada0d5e423de17a347870dd9c2cb8c088b21fc243dd2b5550cc3b46fc49df"]}, 0x45c}, 0x1, 0x0, 0x0, 0x80}, 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:32 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:32 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) 03:35:32 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 499.543634][T15439] binder_alloc: binder_alloc_mmap_handler: 15424 20ff9000-20ffd000 already mapped failed -16 [ 499.557633][T15432] binder: BINDER_SET_CONTEXT_MGR already set [ 499.567251][T15432] binder: 15424:15432 ioctl 40046207 0 returned -16 [ 499.579747][T15444] binder_alloc: 15424: binder_alloc_buf, no vma 03:35:33 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(0xffffffffffffffff, r1, 0x0) [ 499.593197][T15444] binder: 15424:15444 transaction failed 29189/-3, size 0-0 line 3147 [ 499.622138][ T5] binder: release 15424:15439 transaction 371 out, still active 03:35:33 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe3310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 499.641432][ T5] binder: undelivered TRANSACTION_COMPLETE 03:35:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='1cH@'], 0x0, 0x0, 0x0}) [ 499.677420][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 499.700368][ T5] binder: release 15424:15432 transaction 371 in, still active [ 499.712843][ T5] binder: send failed reply for transaction 371, target dead 03:35:33 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(0xffffffffffffffff, r1, 0x0) 03:35:33 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe4310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 499.812789][T15462] binder: 15457:15462 unknown command 1078485809 [ 499.828670][T15462] binder: 15457:15462 ioctl c0306201 20000200 returned -22 03:35:33 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(0xffffffffffffffff, r1, 0x0) [ 500.571174][T15462] binder_alloc: binder_alloc_mmap_handler: 15457 20ff9000-20ffd000 already mapped failed -16 [ 500.581584][T15462] binder: BINDER_SET_CONTEXT_MGR already set [ 500.588087][T15462] binder: 15457:15462 ioctl 40046207 0 returned -16 03:35:36 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe4ffffff, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:36 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:35:36 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:36 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x1000, 0x2c0081) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f00000000c0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 03:35:36 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 502.608092][T15495] binder_alloc: binder_alloc_mmap_handler: 15483 20ff9000-20ffd000 already mapped failed -16 [ 502.639787][T15486] binder: BINDER_SET_CONTEXT_MGR already set 03:35:36 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) [ 502.670630][ T5] binder: release 15483:15495 transaction 375 out, still active [ 502.683054][T15495] binder_alloc: 15483: binder_alloc_buf, no vma [ 502.691634][ T5] binder: undelivered TRANSACTION_COMPLETE [ 502.709935][ T5] binder: release 15483:15486 transaction 375 in, still active 03:35:36 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 502.721377][T15486] binder: 15483:15486 ioctl 40046207 0 returned -16 [ 502.724645][T15495] binder: 15483:15495 transaction failed 29189/-3, size 0-0 line 3147 [ 502.746038][ T5] binder: send failed reply for transaction 375, target dead 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="ca12b609"], 0x0, 0x0, 0x0}) mlock2(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) [ 502.773618][ T5] binder: undelivered TRANSACTION_ERROR: 29189 03:35:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe5310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:36 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:35:36 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 502.863842][T15517] binder: 15515:15517 unknown command 162927306 [ 502.883686][T15517] binder: 15515:15517 ioctl c0306201 20000200 returned -22 [ 502.894214][T15518] binder: 15515:15518 unknown command 162927306 [ 502.910032][T15518] binder: 15515:15518 ioctl c0306201 20000200 returned -22 03:35:36 executing program 0: r0 = msgget(0x1, 0x100) msgctl$MSG_INFO(r0, 0xc, &(0x7f0000000280)=""/182) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\fB\x00\x00'], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x3a, 0x0, 0x40}]}) [ 503.006561][T15530] binder: 15529:15530 unknown command 16908 [ 503.016360][T15530] binder: 15529:15530 ioctl c0306201 20000140 returned -22 [ 503.036369][T15530] binder_alloc: 15529: binder_alloc_buf size 35184372088832 failed, no address space [ 503.060476][T15530] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 16384 (num: 1 largest: 16384) [ 503.073195][T15530] binder: 15529:15530 transaction failed 29201/-28, size 0-0 line 3147 [ 503.100542][T15536] binder_alloc: binder_alloc_mmap_handler: 15529 20ff9000-20ffd000 already mapped failed -16 [ 503.119309][T15536] binder: 15529:15536 unknown command 16908 [ 503.119444][T15530] binder: BINDER_SET_CONTEXT_MGR already set [ 503.129484][T15536] binder: 15529:15536 ioctl c0306201 20000140 returned -22 [ 503.143123][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 503.154208][T15530] binder: 15529:15530 ioctl 40046207 0 returned -16 03:35:36 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe6310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae8a, &(0x7f0000000000)) 03:35:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:36 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 503.467501][T15553] binder_alloc: binder_alloc_mmap_handler: 15543 20ff9000-20ffd000 already mapped failed -16 [ 503.482351][T15546] binder: BINDER_SET_CONTEXT_MGR already set [ 503.508364][T15546] binder: 15543:15546 ioctl 40046207 0 returned -16 [ 503.508411][T15553] binder_alloc: 15543: binder_alloc_buf, no vma [ 503.515059][ T5] binder: release 15543:15553 transaction 380 out, still active [ 503.524355][T15553] binder: 15543:15553 transaction failed 29189/-3, size 0-0 line 3147 [ 503.538570][ T5] binder: undelivered TRANSACTION_COMPLETE 03:35:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 503.554729][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.570607][ T5] binder: release 15543:15546 transaction 380 in, still active 03:35:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4040aea0, &(0x7f0000000000)={0x100000000000020e}) 03:35:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe7310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 503.603720][ T5] binder: send failed reply for transaction 380, target dead [ 503.689466][T15570] binder: 15563:15570 got reply transaction with no transaction stack [ 503.705435][T15570] binder: 15563:15570 transaction failed 29201/-71, size 0-0 line 2899 [ 504.439238][T15578] binder_alloc: binder_alloc_mmap_handler: 15563 20ff9000-20ffd000 already mapped failed -16 [ 504.449619][T15570] binder: BINDER_SET_CONTEXT_MGR already set [ 504.456063][T15570] binder: 15563:15570 ioctl 40046207 0 returned -16 [ 504.456143][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:35:39 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:39 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-net\x00', 0x2, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/123, 0x47}], 0x1, 0x0) 03:35:39 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe8310100, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:39 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:39 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x10000, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f00000000c0)={0x8, 0x2, 0x6, 0x200, "4f240783baaed512eddf0304cd62f4328bcbab19acda822d14dfae373f745598"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) fremovexattr(r0, &(0x7f0000000040)=@known='security.apparmor\x00') [ 506.031378][T15593] binder_alloc: binder_alloc_mmap_handler: 15581 20ff9000-20ffd000 already mapped failed -16 [ 506.055580][T15584] binder: BINDER_SET_CONTEXT_MGR already set [ 506.064107][T15584] binder: 15581:15584 ioctl 40046207 0 returned -16 03:35:39 executing program 0: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = socket$caif_seqpacket(0x25, 0x5, 0x3) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080), 0x10) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x100, 0x8) ioctl$KDGKBLED(r2, 0x4b64, &(0x7f0000000180)) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)=@known='system.posix_acl_default\x00') ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:39 executing program 5: clone(0x10013102041ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x3, 0x103, 0x3e}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000200)) [ 506.074390][ T7855] binder: release 15581:15584 transaction 385 in, still active [ 506.087156][ T7855] binder: send failed reply for transaction 385 to 15581:15593 [ 506.104522][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 506.111830][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:35:39 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0ffffff, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:39 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) capset(0x0, 0x0) [ 506.205974][T15607] binder: 15604:15607 ioctl c0306201 20000140 returned -11 [ 506.229796][T15607] binder: 15604:15607 got transaction to context manager from process owning it [ 506.246734][T15607] binder: 15604:15607 transaction failed 29201/-22, size 0-0 line 2985 [ 506.264394][T15615] binder_alloc: binder_alloc_mmap_handler: 15604 20ff9000-20ffd000 already mapped failed -16 [ 506.281014][T15614] binder: BINDER_SET_CONTEXT_MGR already set [ 506.295805][T15614] binder: 15604:15614 ioctl 40046207 0 returned -16 [ 506.305604][T15614] binder: 15604:15614 got transaction to context manager from process owning it [ 506.315460][T15614] binder: 15604:15614 transaction failed 29201/-22, size 0-0 line 2985 03:35:39 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfeffffff, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 506.350934][ T26] audit: type=1326 audit(2000000139.859:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15613 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 [ 506.379685][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 507.072608][ T26] audit: type=1326 audit(2000000140.579:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15613 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:35:42 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, 0x0) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) 03:35:42 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xff7f0000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:42 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:42 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) pipe2(0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$binfmt_aout(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000000000000000008000000000000000000001c3adde6863809aa0000004e2311d180fbf902bf4059f358dc1ab73301f0ffffc2eed78c43937aad9a85afe827389338a0ddbe9f63e9b1a3abe483620de2d94fcadcb572c54f42bb8c0d7de02d9bf774a2d8fa246a1f22796dbb1ceeb7bd438081598f12acde0bf8cde4f051bea442f46e964fc79e6a1ef2fc533e4c9b0036d4f4443a273f0ec003ff00eb19b4fdc7de34de39ed145571230ab02c89bc39f65ba52646a67b733958b24c6f2624191a334f913026b86d7fa03cebaa7c45dcf82769f29e83bfaa7f103cdcecc965d75d880b7a6ea60fbf2b9cc4616742d607788f2ff5ab53706ea929058d05a8f8ab6e151114442eb2fc431b7574b73dcfcdb520a5d4839f404a02620f7c2ec21322cf59ebcc73da47d545b8598fce7d10913f6f67bbd8bd55234c226198e3e7b3bf24cfb9de6785"], 0x149) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r2, r2, &(0x7f0000000000), 0x8080fffffffe) 03:35:42 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 509.118798][T15649] binder_alloc: binder_alloc_mmap_handler: 15635 20ff9000-20ffd000 already mapped failed -16 [ 509.139262][T15636] binder: BINDER_SET_CONTEXT_MGR already set [ 509.157433][T15636] binder: 15635:15636 ioctl 40046207 0 returned -16 03:35:42 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 509.175858][T15649] binder_alloc: 15635: binder_alloc_buf, no vma [ 509.191358][ T7855] binder: release 15635:15649 transaction 390 out, still active [ 509.203682][T15649] binder: 15635:15649 transaction failed 29189/-3, size 0-0 line 3147 03:35:42 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffa888, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 509.235388][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 509.256200][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 509.273646][ T7855] binder: release 15635:15636 transaction 390 in, still active 03:35:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x40000, 0x0) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f00000000c0)) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x1d, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\f\x00\x00'], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="2b8648f3"], 0x0, 0x0, 0x0}) [ 509.304054][ T7855] binder: send failed reply for transaction 390, target dead [ 509.367882][T15663] binder: 15662:15663 unknown command 12 [ 509.376187][T15663] binder: 15662:15663 ioctl c0306201 20000140 returned -22 [ 509.393105][T15663] binder: 15662:15663 unknown command -213350869 [ 509.402826][T15663] binder: 15662:15663 ioctl c0306201 20000200 returned -22 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x800, 0x0) ioctl$GIO_CMAP(r2, 0x4b70, &(0x7f00000000c0)) [ 509.424407][T15665] binder: 15662:15665 unknown command 12 [ 509.430295][T15663] binder: BINDER_SET_CONTEXT_MGR already set [ 509.438794][T15663] binder: 15662:15663 ioctl 40046207 0 returned -16 [ 509.447383][T15665] binder: 15662:15665 ioctl c0306201 20000140 returned -22 [ 509.455295][T15663] binder: 15662:15663 unknown command -213350869 [ 509.463339][T15663] binder: 15662:15663 ioctl c0306201 20000200 returned -22 03:35:43 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfffff000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 509.587315][T15671] binder_alloc: binder_alloc_mmap_handler: 15668 20ff9000-20ffd000 already mapped failed -16 [ 509.609153][T15669] binder: BINDER_SET_CONTEXT_MGR already set [ 509.623321][T15669] binder: 15668:15669 ioctl 40046207 0 returned -16 [ 509.642614][T15671] binder_alloc: 15668: binder_alloc_buf, no vma [ 509.653012][T15671] binder: 15668:15671 transaction failed 29189/-3, size 0-0 line 3147 [ 509.667335][ T5] binder: release 15668:15671 transaction 394 out, still active [ 509.677415][ T5] binder: undelivered TRANSACTION_COMPLETE 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\bc\x00\x00'], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000000c0)=0x0) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000180)=r3) ioctl$void(r1, 0x5451) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 509.689297][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 509.702940][ T5] binder: release 15668:15669 transaction 394 in, still active [ 509.716469][ T5] binder: send failed reply for transaction 394, target dead 03:35:43 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffff7f, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 509.767609][T15679] binder: 15678:15679 unknown command 25352 [ 509.773967][T15679] binder: 15678:15679 ioctl c0306201 20000140 returned -22 [ 509.800625][T15679] binder: 15678:15679 ioctl 540f 200000c0 returned -22 [ 509.814150][T15681] binder_alloc: binder_alloc_mmap_handler: 15678 20ff9000-20ffd000 already mapped failed -16 [ 509.830107][T15679] binder: BINDER_SET_CONTEXT_MGR already set [ 509.850162][T15681] binder: 15678:15681 unknown command 25352 03:35:43 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:43 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) [ 509.873970][T15679] binder: 15678:15679 ioctl 40046207 0 returned -16 [ 509.930925][T15681] binder: 15678:15681 ioctl c0306201 20000140 returned -22 [ 509.930949][T15690] binder: 15678:15690 ioctl 540f 200000c0 returned -22 03:35:43 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) fchmodat(0xffffffffffffffff, 0x0, 0x0) [ 509.993496][ T5] binder: release 15678:15679 transaction 397 out, still active [ 510.003340][ T5] binder: undelivered TRANSACTION_COMPLETE [ 510.018769][ T5] binder: send failed reply for transaction 397, target dead 03:35:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f00000000c0), &(0x7f0000000100)=0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x40, 0x0, 0x3, 0xc, 0xd7fa, 0x1}, 0x20) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 510.052008][ T26] audit: type=1326 audit(2000000143.559:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15699 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:35:43 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) [ 510.157927][T15707] binder_alloc: binder_alloc_mmap_handler: 15704 20ff9000-20ffd000 already mapped failed -16 [ 510.182683][T15707] binder: BINDER_SET_CONTEXT_MGR already set [ 510.189502][T15707] binder: 15704:15707 ioctl 40046207 0 returned -16 [ 510.197097][T15705] binder_alloc: 15704: binder_alloc_buf, no vma [ 510.203598][ T5] binder: release 15704:15705 transaction 399 out, still active [ 510.213199][T15705] binder: 15704:15705 transaction failed 29189/-3, size 0-0 line 3147 [ 510.222762][ T5] binder: undelivered TRANSACTION_COMPLETE [ 510.234377][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 510.241174][ T5] binder: send failed reply for transaction 399, target dead [ 510.850181][ T26] audit: type=1326 audit(2000000144.359:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15699 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:35:45 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:45 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffff9e, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0xfffffffffffffffd, 0xa00) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000180)={0x9, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0xa67b2a58c9b0bffe, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) prctl$PR_SET_TSC(0x1a, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:45 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) 03:35:45 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:45 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)}, 0x0) [ 512.319238][ T26] audit: type=1326 audit(2000000145.829:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15721 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:35:45 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(0xffffffffffffffff, r1, 0x0) [ 512.405002][T15719] binder: BINDER_SET_CONTEXT_MGR already set [ 512.420476][ T7855] binder: release 15717:15732 transaction 402 out, still active [ 512.429744][T15719] binder: 15717:15719 ioctl 40046207 0 returned -16 [ 512.439360][ T7855] binder: undelivered TRANSACTION_COMPLETE 03:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x200080, 0x0) ioctl$BLKROTATIONAL(r1, 0x127e, &(0x7f00000000c0)) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:46 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffffe4, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 512.462704][ T7855] binder: release 15717:15719 transaction 402 in, still active [ 512.485991][ T7855] binder: send failed reply for transaction 402, target dead [ 512.619395][T15748] binder_alloc: binder_alloc_mmap_handler: 15740 20ff9000-20ffd000 already mapped failed -16 [ 512.632717][T15741] binder: BINDER_SET_CONTEXT_MGR already set [ 512.642562][ T5] binder: release 15740:15748 transaction 404 out, still active [ 512.650346][T15741] binder: 15740:15741 ioctl 40046207 0 returned -16 [ 512.657403][ T5] binder: undelivered TRANSACTION_COMPLETE 03:35:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = accept4$tipc(0xffffffffffffff9c, &(0x7f0000000080), &(0x7f00000000c0)=0x10, 0x80000) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000180)=""/99, &(0x7f0000000280)=0x63) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 512.663279][ T5] binder: release 15740:15741 transaction 404 in, still active [ 512.685322][ T5] binder: send failed reply for transaction 404, target dead 03:35:46 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfffffff0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 512.808332][T15759] binder_alloc: binder_alloc_mmap_handler: 15752 20ff9000-20ffd000 already mapped failed -16 [ 512.831376][T15753] binder: BINDER_SET_CONTEXT_MGR already set [ 512.847454][T15753] binder: 15752:15753 ioctl 40046207 0 returned -16 03:35:46 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfffffffe, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 512.848263][ T7855] binder: send failed reply for transaction 406 to 15752:15759 [ 512.871060][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 512.880046][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 513.119307][ T26] audit: type=1326 audit(2000000146.629:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15721 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:35:48 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x1, &(0x7f0000000080)=[0x0]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000080)={0x0, @aes256}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x4f, 0x200000) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000180)={'bridge0\x00', 0x7}) 03:35:48 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x6087ffffffff, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:48 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:48 executing program 5: add_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)="0455a913498e4f4fc0a9a99432ac6fb52ec557971ea01e02f7638a9bc73d2dc7dd4b47f98ff80682d8a7642bb9c4aa005c4f90890cf452cb9efb4f2f92d2064667662b6b5888dbfd0f6005a06f5c16b951d2a084585d16005995f6c81ac45cafd3aed32460fff7753f4acebdfe6be27334b0a6cb67a3a47cfcae0392473155", 0x7f, 0xfffffffffffffffc) 03:35:48 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(0xffffffffffffffff, r1, 0x0) 03:35:48 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) timerfd_create(0x0, 0x0) 03:35:49 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x1, &(0x7f0000000080)=[0x0]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 515.437781][T15785] binder: 15774:15785 ioctl 40106614 20000080 returned -22 [ 515.485029][T15785] binder_alloc: binder_alloc_mmap_handler: 15774 20ff9000-20ffd000 already mapped failed -16 [ 515.519128][ T26] audit: type=1326 audit(2000000149.029:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15790 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 [ 515.544118][T15796] binder: BINDER_SET_CONTEXT_MGR already set [ 515.550749][T15796] binder: 15774:15796 ioctl 40046207 0 returned -16 03:35:49 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x1, &(0x7f0000000080)=[0x0]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:49 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0ffffffffffff, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 515.589663][T15780] binder: 15774:15780 ioctl 40106614 20000080 returned -22 [ 515.603595][T15796] binder_alloc: 15774: binder_alloc_buf, no vma [ 515.611077][T15796] binder: 15774:15796 transaction failed 29189/-3, size 0-0 line 3147 [ 515.632326][ T7855] binder_thread_release: 1 callbacks suppressed 03:35:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x4) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x400040, 0x0) sendto$rose(r2, &(0x7f0000000180)="49b567bf89f9fa409f80b54fce31a900458e9b9161e7b3a09293fa4a83a60c01519fee07610751b297231a850862465e0d06536b3196b6e767959d4d7330606caed925d939d2ebe0f6eb0e28352abf3a3940f19a40d3067d6c5ef329", 0x5c, 0x20000000, 0x0, 0x0) r3 = fcntl$dupfd(r1, 0x406, r0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f0000000280)={{0x101, 0xffffffff, 0x1, 0x91e, 0x2, 0x2}, 0x2, 0x1, 0xfffffffffffffff7, 0x5, 0x2, "b2ce26e3e2fb8f7a642d4c7ecea6c3e7e23fe90b3407207da65464dd564ca80cd3b69b555537393bf9c44515ad3f3d017c837142acd452f5735193298ed0b8ca6c309407c80e1e4e4f98f72f3e3f09c2f842b6dd213c9d5facff300dc57e372df4d8b1156ee10b794ef320fedf7ec0a3333c0b8f378a4bbc4736a75a9132eb2d"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="f55a9a62bbd8fe21f01696b27814036c922b0a009930100d3320ee5016ed60df140fc28be3342e3bc99f91a141d368314e5e56fb290092af29a20246495dbdc9a73ca69f0167484ea7ab48990b8b93a4dbc59b1e51"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="01633d40"], 0x0, 0x0, 0x0}) [ 515.632338][ T7855] binder: release 15774:15785 transaction 408 out, still active [ 515.661974][ T7855] binder: undelivered TRANSACTION_COMPLETE 03:35:49 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x1, &(0x7f0000000080)=[0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 515.685713][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 515.700837][ T7855] binder: release 15774:15780 transaction 408 in, still active [ 515.709456][ T7855] binder: send failed reply for transaction 408, target dead [ 515.771589][T15809] binder: 15806:15809 ioctl 800448d3 20000280 returned -22 [ 515.780863][T15809] binder: 15806:15809 unknown command 1654282997 [ 515.788412][T15809] binder: 15806:15809 ioctl c0306201 20000140 returned -22 [ 515.797004][T15809] binder: 15806:15809 unknown command 1077764865 [ 515.803843][T15809] binder: 15806:15809 ioctl c0306201 20000200 returned -22 [ 515.811662][T15813] binder_alloc: binder_alloc_mmap_handler: 15806 20ff9000-20ffd000 already mapped failed -16 03:35:49 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x1, &(0x7f0000000080)=[0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:35:49 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x100000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 515.846335][T15809] binder: BINDER_SET_CONTEXT_MGR already set [ 515.846424][T15814] binder: 15806:15814 ioctl 800448d3 20000280 returned -22 [ 515.861021][T15815] binder: 15806:15815 unknown command 1654282997 [ 515.890716][T15815] binder: 15806:15815 ioctl c0306201 20000140 returned -22 [ 515.913800][T15813] binder: 15806:15813 unknown command 1077764865 03:35:49 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x1, &(0x7f0000000080)=[0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 515.935898][T15809] binder: 15806:15809 ioctl 40046207 0 returned -16 [ 515.942944][T15813] binder: 15806:15813 ioctl c0306201 20000200 returned -22 03:35:49 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="b5f7dee1a7156fc508b790583ccc60936b7fb1265989b8fd5ae99a16c4d54962118db19c7251a315beb3634ecff068b6a33dba27b736e402fbbc027d23b7545adca9e3b5b7d26fb66c14e668e45a4c043c6500955733705bd0e75a3590b8f6cb15404f660d60b43c9591c67142f1ec6c7d5a4caccc388f51b53771429dc8f2745909171137581af6cf8e5236d71246393b120cc7"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:49 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) [ 516.223535][T15831] binder: 15829:15831 unknown command -505481291 [ 516.243297][T15831] binder: 15829:15831 ioctl c0306201 20000140 returned -22 [ 516.269368][T15831] binder: 15829:15831 transaction failed 29189/-22, size 0-0 line 2994 [ 516.281614][ T26] audit: type=1326 audit(2000000149.789:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=15790 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 [ 516.306773][T15837] binder_alloc: binder_alloc_mmap_handler: 15829 20ff9000-20ffd000 already mapped failed -16 03:35:49 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(0xffffffffffffffff, r1, 0x0) 03:35:49 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x200000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:49 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x34000, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x38}}, 0x0) [ 516.333155][T15831] binder: 15829:15831 unknown command -505481291 [ 516.340159][T15837] binder: 15829:15837 transaction failed 29189/-22, size 0-0 line 2994 [ 516.348644][T15831] binder: 15829:15831 ioctl c0306201 20000140 returned -22 [ 516.356595][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 516.371625][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:35:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:35:50 executing program 5: sysfs$2(0x2, 0x0, &(0x7f0000000200)=""/4096) 03:35:50 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x300000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000000)={'ah\x00'}, &(0x7f0000000040)=0x1e) 03:35:50 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x34000, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) [ 516.630336][T15861] binder: 15848:15861 got transaction to invalid handle [ 516.649443][T15861] binder: 15848:15861 transaction failed 29201/-22, size 0-0 line 2994 03:35:50 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x400000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:50 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:50 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r2, 0x4, 0x6c00) dup3(r0, r1, 0x0) write$P9_RWSTAT(0xffffffffffffffff, 0x0, 0x0) [ 517.261112][T15864] binder: BINDER_SET_CONTEXT_MGR already set [ 517.267808][T15861] binder: 15848:15861 got transaction to invalid handle [ 517.275099][T15861] binder: 15848:15861 transaction failed 29201/-22, size 0-0 line 2994 [ 517.284497][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 517.291007][T15864] binder: 15848:15864 ioctl 40046207 0 returned -16 [ 517.298449][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:35:52 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 03:35:52 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x500000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:52 executing program 5: r0 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x0) fsync(r0) 03:35:52 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:35:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0c630077973f00000000000001a2a3a601cd9fc6781bcb0849f8ba6d21"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163684029f942c5c944773816b57d5c2c5d98352de2d96ab492d415923c5310807c350c36087173ad10f1fe4a82a214614942f7542939977a251893bb00000000e305fd7253f6e1ca3beb5db03f0bc6a63d450a4c6f99a03e3c5dbc2308f1bb0a3ea04d22fc4efe82a7c0359dd2af6f7d0daa2dbcc751209ee02cf6d47b89a6fffaf4109c0f32d0361bf2e76bf48ac41bb4e4a7cfef06e5b90eb5d96a7ed9742a0ecf8154c5ad65a7393dbb518b6c08604f8392d7a63862abf87ace3c9d4c389a6132"], 0x0, 0x0, 0x0}) 03:35:52 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:52 executing program 5: 03:35:52 executing program 5: [ 519.296766][T15895] binder: 15888:15895 unknown command 1996514060 [ 519.312121][T15895] binder: 15888:15895 ioctl c0306201 20000140 returned -22 [ 519.334304][T15895] binder: 15888:15895 unknown command 1080582929 03:35:52 executing program 5: [ 519.360597][T15895] binder: 15888:15895 ioctl c0306201 20000200 returned -22 [ 519.381827][T15906] binder: BINDER_SET_CONTEXT_MGR already set [ 519.392160][T15906] binder: 15888:15906 ioctl 40046207 0 returned -16 [ 519.403535][T15895] binder: 15888:15895 unknown command 1996514060 03:35:52 executing program 5: [ 519.414978][T15906] binder: 15888:15906 unknown command 1080582929 [ 519.430333][T15895] binder: 15888:15895 ioctl c0306201 20000140 returned -22 [ 519.439980][T15906] binder: 15888:15906 ioctl c0306201 20000200 returned -22 03:35:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x0, @null, @rose={'rose', 0x0}, 0x3, 'syz1\x00', @default, 0x9, 0x7, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:53 executing program 5: [ 519.572670][T15913] binder: 15912:15913 unknown command 0 [ 519.578720][T15913] binder: 15912:15913 ioctl c0306201 20000140 returned -22 [ 519.588022][T15913] binder: 15912:15913 ioctl 890b 20000080 returned -22 [ 519.597597][T15914] binder_alloc: binder_alloc_mmap_handler: 15912 20ff9000-20ffd000 already mapped failed -16 [ 519.608371][T15913] binder: BINDER_SET_CONTEXT_MGR already set [ 519.614401][T15913] binder: 15912:15913 ioctl 40046207 0 returned -16 [ 519.621104][T15914] binder: 15912:15914 unknown command 0 [ 519.626803][T15914] binder: 15912:15914 ioctl c0306201 20000140 returned -22 [ 519.634843][T15914] binder: 15912:15914 ioctl 890b 20000080 returned -22 [ 519.634866][T15915] binder_alloc: 15912: binder_alloc_buf, no vma [ 519.648350][T15915] binder: 15912:15915 transaction failed 29189/-3, size 0-0 line 3147 [ 519.656849][ T7855] binder: release 15912:15913 transaction 418 out, still active [ 519.664492][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 519.670943][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 519.677260][ T7855] binder: send failed reply for transaction 418, target dead 03:35:55 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 03:35:55 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x600000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:55 executing program 5: 03:35:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c630010"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$VT_ACTIVATE(r2, 0x5606, 0x684) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0xe0000, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000180)="93c8d38c276a00f2baa871eddb4915b9a873ebde2338edbe2fa293abc0a81eafa1a94c13bd3a13eb5fbd1f35abe4e1ed68ac154a018641f8b78c025f94d207c9619268a1fc62bc2b8a8affefd0c30cc88e31f6434170fe540185d4ef8a22a6779553ccf39d8d1d", 0x67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:55 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:55 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) [ 522.339807][T15926] binder: 15920:15926 unknown command 268460812 [ 522.351502][T15926] binder: 15920:15926 ioctl c0306201 20000140 returned -22 [ 522.362857][T15929] binder_alloc: binder_alloc_mmap_handler: 15920 20ff9000-20ffd000 already mapped failed -16 [ 522.374088][T15926] binder: BINDER_SET_CONTEXT_MGR already set [ 522.381977][T15929] binder: 15920:15929 unknown command 268460812 03:35:55 executing program 5: [ 522.393891][T15926] binder: 15920:15926 ioctl 40046207 0 returned -16 [ 522.409502][T15929] binder: 15920:15929 ioctl c0306201 20000140 returned -22 [ 522.424872][ T7855] binder: release 15920:15926 transaction 421 out, still active 03:35:56 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:35:56 executing program 5: 03:35:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000280)={0x0, 0x83, "7cd3e717b69772db5c27fbb1437e2da2cfa7115133c386f4051a7b8e3dcedcd18e9ef0cbfa52185c2d3571cc2a2b44a6167de157134d2b4bad7bb748f832f9ce0501fb610af35a00a46932112d836a72bcbd026a064c8294ad47a09bfabe4f122bfc6acca85e244a6e6fad5a52feee29fc1042ed51fa97d00e68aeda40ea842e0f64fa"}, &(0x7f00000000c0)=0x8b) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000180)={r3, 0x1000}, &(0x7f00000001c0)=0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1163c840"], 0x0, 0x0, 0x0}) [ 522.455463][ T7855] binder: undelivered TRANSACTION_COMPLETE [ 522.484533][ T7855] binder: send failed reply for transaction 421, target dead 03:35:56 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:35:56 executing program 5: 03:35:56 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x700000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:56 executing program 5: [ 522.618970][T15948] binder: 15943:15948 unknown command 1086874385 [ 522.643519][T15948] binder: 15943:15948 ioctl c0306201 20000200 returned -22 03:35:56 executing program 1: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:35:56 executing program 5: 03:35:56 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(0xffffffffffffffff, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:56 executing program 5: 03:35:56 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x800000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:56 executing program 4: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) socketpair$unix(0x1, 0x2000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:35:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae91, &(0x7f0000000000)) [ 523.363573][T15948] binder_alloc: binder_alloc_mmap_handler: 15943 20ff9000-20ffd000 already mapped failed -16 [ 523.388470][T15948] binder: BINDER_SET_CONTEXT_MGR already set [ 523.397113][T15948] binder: 15943:15948 ioctl 40046207 0 returned -16 [ 523.404161][T15987] binder: 15943:15987 unknown command 1086874385 03:35:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") r1 = syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x1, 0x2) ioctl$int_in(r1, 0x800040c004500a, &(0x7f0000000040)=0x80000002) ioctl$int_in(r1, 0x5421, &(0x7f0000000200)=0x4) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000000c0)={0xffffffffffffffd3, 0x2, 0x10000000d000000, {0x300000000000000}}, 0xfffffefd) 03:35:56 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x900000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 523.414197][T15987] binder: 15943:15987 ioctl c0306201 20000200 returned -22 03:35:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x34}]}) 03:35:57 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='limits\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) [ 523.562543][T15995] binder_alloc: binder_alloc_mmap_handler: 15994 20ff9000-20ffd000 already mapped failed -16 [ 523.596577][ T5] binder: release 15994:16001 transaction 424 out, still active [ 523.614136][T15995] binder: BINDER_SET_CONTEXT_MGR already set [ 523.620571][ T5] binder: undelivered TRANSACTION_COMPLETE [ 523.636985][T15995] binder: 15994:15995 ioctl 40046207 0 returned -16 [ 523.639891][ T5] binder: release 15994:15995 transaction 424 in, still active [ 523.652525][ T5] binder: send failed reply for transaction 424, target dead 03:35:59 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x11ce477b3308586a, 0x0) 03:35:59 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:35:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x40, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f00000000c0)={0x2, "3f06"}, 0x3) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) getsockopt$inet6_dccp_int(r1, 0x21, 0x6, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:35:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:35:59 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:35:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:35:59 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 525.820145][T16024] binder_alloc: binder_alloc_mmap_handler: 16010 20ff9000-20ffd000 already mapped failed -16 [ 525.851128][T16011] binder: BINDER_SET_CONTEXT_MGR already set [ 525.877975][T16024] binder_alloc: 16010: binder_alloc_buf, no vma [ 525.884569][T16024] binder: 16010:16024 transaction failed 29189/-3, size 0-0 line 3147 [ 525.894611][ T5] binder: release 16010:16023 transaction 426 out, still active [ 525.898457][T16028] binder: BINDER_SET_CONTEXT_MGR already set [ 525.903175][T16011] binder: 16010:16011 ioctl 40046207 0 returned -16 [ 525.915780][T16028] binder: 16012:16028 ioctl 40046207 0 returned -16 [ 525.924075][ T5] binder: undelivered TRANSACTION_COMPLETE [ 525.942195][ T5] binder: undelivered TRANSACTION_ERROR: 29189 03:35:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000080)={0x3f, 0x1, 0xed74, 0x0, 0x3ff}, 0xc) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="21e2ff0f58d996ebbf08a4"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 525.969982][ T5] binder: release 16010:16011 transaction 426 in, still active [ 525.987247][ T5] binder: send failed reply for transaction 426, target dead 03:35:59 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 526.010582][T16013] binder: 16012:16013 got transaction to invalid handle [ 526.045612][T16013] binder: 16012:16013 transaction failed 29201/-22, size 0-0 line 2994 03:35:59 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 526.077619][T16037] binder: BINDER_SET_CONTEXT_MGR already set [ 526.087517][T16029] binder: 16019:16029 got transaction to invalid handle [ 526.098483][T16029] binder: 16019:16029 transaction failed 29201/-22, size 0-0 line 2994 [ 526.111977][T16037] binder: 16035:16037 ioctl 40046207 0 returned -16 [ 526.124122][T16037] binder: 16035:16037 unknown command 268427809 [ 526.132774][T16037] binder: 16035:16037 ioctl c0306201 20000140 returned -22 [ 526.141218][T16037] binder_alloc: 16019: binder_alloc_buf, no vma [ 526.147949][T16037] binder: 16035:16037 transaction failed 29189/-3, size 0-0 line 3147 [ 526.160583][T16043] binder: BINDER_SET_CONTEXT_MGR already set [ 526.167123][T16043] binder: 16035:16043 ioctl 40046207 0 returned -16 03:35:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x400000, 0x0) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000240)=""/99) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r2, &(0x7f00000003c0)={0x90, 0x0, 0x1, {0x4, 0x2, 0x400, 0x6, 0x6, 0x0, {0x1, 0x8, 0x7, 0xfffffffffffff001, 0x0, 0x0, 0x20, 0x8, 0x7578cfb9, 0x5, 0x1ff, r3, r4, 0x0, 0x8}}}, 0x90) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="e16dd1c5fd061240824b6fd3c251ec8fb1c6068bb57fdf86508cae5f9fdb537f8d07247b4f23f3c0312d786d4c75a43ede6d7b06c3e78930e86ffd448714d63446df659f02b87db7fec1fd59b50bf240d0495c70f3eff00384507c87ff671a928853a1d04228eea7f7939817edc0970000"], 0x0, 0x0, 0x0}) [ 526.174524][T16037] binder: 16035:16037 unknown command 268427809 [ 526.181242][T16043] binder_alloc: 16019: binder_alloc_buf, no vma [ 526.187978][T16037] binder: 16035:16037 ioctl c0306201 20000140 returned -22 [ 526.196166][T16043] binder: 16035:16043 transaction failed 29189/-3, size 0-0 line 3147 [ 526.205098][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 526.213260][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:35:59 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 526.281739][T16047] binder: BINDER_SET_CONTEXT_MGR already set [ 526.295109][T16047] binder: 16046:16047 ioctl 40046207 0 returned -16 03:35:59 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x1000000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 526.367216][T16052] binder: 16046:16052 unknown command -976130591 [ 526.373819][T16052] binder: 16046:16052 ioctl c0306201 20000200 returned -22 03:36:00 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x1f00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:00 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 526.565923][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 526.585425][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:00 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:36:00 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x2000000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 526.839366][T16082] binder: 16072:16082 got transaction to invalid handle [ 526.859203][T16083] binder: BINDER_SET_CONTEXT_MGR already set [ 526.862810][T16082] binder: 16072:16082 transaction failed 29201/-22, size 0-0 line 2994 [ 526.872236][T16083] binder: 16081:16083 ioctl 40046207 0 returned -16 03:36:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 526.910408][T16083] binder_alloc: 16072: binder_alloc_buf, no vma [ 526.917471][T16083] binder: 16081:16083 transaction failed 29189/-3, size 0-0 line 3147 [ 526.919818][ T5] binder: undelivered TRANSACTION_ERROR: 29189 03:36:00 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x230f000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 527.014062][T16091] binder: BINDER_SET_CONTEXT_MGR already set [ 527.028824][T16091] binder: 16090:16091 ioctl 40046207 0 returned -16 [ 527.055789][T16091] binder_alloc: 16072: binder_alloc_buf, no vma [ 527.077184][T16052] binder: BINDER_SET_CONTEXT_MGR already set [ 527.083062][T16091] binder: 16090:16091 transaction failed 29189/-3, size 0-0 line 3147 [ 527.092058][T16052] binder: 16046:16052 ioctl 40046207 0 returned -16 [ 527.100390][T16095] binder: 16046:16095 unknown command -976130591 [ 527.109932][T16095] binder: 16046:16095 ioctl c0306201 20000200 returned -22 [ 527.126603][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 527.495532][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:02 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:36:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x20800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x7) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="10634840"], 0x0, 0x0, 0x0}) 03:36:02 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x3f00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:02 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, 0x0, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:36:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 529.156997][T16111] binder: 16103:16111 ioctl c0306201 20000140 returned -11 [ 529.164922][T16108] binder: BINDER_SET_CONTEXT_MGR already set [ 529.181409][T16111] binder: 16103:16111 unknown command 1078485776 [ 529.202574][T16108] binder: 16104:16108 ioctl 40046207 0 returned -16 [ 529.210856][T16111] binder: 16103:16111 ioctl c0306201 20000200 returned -22 [ 529.228907][T16118] binder_alloc: binder_alloc_mmap_handler: 16103 20ff9000-20ffd000 already mapped failed -16 [ 529.247500][T16108] binder_alloc: 16103: binder_alloc_buf, no vma [ 529.254264][T16118] binder: BINDER_SET_CONTEXT_MGR already set [ 529.261155][T16108] binder: 16104:16108 transaction failed 29189/-3, size 0-0 line 3147 [ 529.274186][T16118] binder: 16103:16118 ioctl 40046207 0 returned -16 [ 529.283290][T16107] binder: BINDER_SET_CONTEXT_MGR already set [ 529.291518][T16107] binder: 16106:16107 ioctl 40046207 0 returned -16 [ 529.299224][T16118] binder: 16103:16118 unknown command 1078485776 03:36:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c630004"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) [ 529.311478][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.312035][T16118] binder: 16103:16118 ioctl c0306201 20000200 returned -22 03:36:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 529.358017][T16122] binder: 16106:16122 got transaction to invalid handle [ 529.383180][T16122] binder: 16106:16122 transaction failed 29201/-22, size 0-0 line 2994 03:36:02 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x4000000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 529.419349][T16127] binder: 16125:16127 unknown command 67134220 [ 529.437616][T16127] binder: 16125:16127 ioctl c0306201 20000140 returned -22 [ 529.448181][T16129] binder: BINDER_SET_CONTEXT_MGR already set [ 529.466188][T16129] binder: 16124:16129 ioctl 40046207 0 returned -16 [ 529.474805][T16131] binder_alloc: binder_alloc_mmap_handler: 16125 20ff9000-20ffd000 already mapped failed -16 [ 529.488081][T16127] binder: BINDER_SET_CONTEXT_MGR already set [ 529.506742][T16131] binder: 16125:16131 unknown command 67134220 03:36:03 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 529.513394][T16127] binder: 16125:16127 ioctl 40046207 0 returned -16 [ 529.524233][T16131] binder: 16125:16131 ioctl c0306201 20000140 returned -22 [ 529.542783][ T5] binder: release 16125:16131 transaction 441 out, still active [ 529.555101][ T5] binder: undelivered TRANSACTION_COMPLETE 03:36:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x580, 0x125600) ioctl$DRM_IOCTL_IRQ_BUSID(r2, 0xc0106403, &(0x7f0000000180)={0xfc5, 0x1d}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="8c639900"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) openat$cachefiles(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cachefiles\x00', 0x400200, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000280)={{0x6, 0x3}, {0x9, 0x1000}, 0x9, 0x0, 0x3ff}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="004982d327990000000000000000"], 0x0, 0x0, 0x0}) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000080)={0x6, 0x6, 0x1, 0x0, 0x0, [{r1, 0x0, 0xfffffffffffeffff}]}) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000003c0)=@nat={'nat\x00', 0x1b, 0x5, 0x460, 0x1d0, 0x3c8, 0x100, 0x2a0, 0x2a0, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x5, &(0x7f0000000340), {[{{@uncond, 0x0, 0xc8, 0x100, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x1, 0x5, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x18, @empty, @empty, @gre_key=0x7, @icmp_id=0x68}}}}, {{@uncond, 0x0, 0x98, 0xd0}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast1, @local, @port=0x4e21, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xd0}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x2, @remote, @broadcast, @port=0x4e23, @gre_key=0x9}}}}, {{@uncond, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x2, 0x0, 0x1}}, @common=@icmp={0x28, 'icmp\x00', 0x0, {0x15, 0x77a2, 0x205, 0x1}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0xc, @rand_addr, @loopback, @gre_key=0x8, @gre_key=0x6}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x4c0) [ 529.579147][ T5] binder: send failed reply for transaction 441, target dead 03:36:03 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x4800000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 529.700792][T16144] binder: 16139:16144 unknown command 10052492 [ 529.708184][T16144] binder: 16139:16144 ioctl c0306201 20000140 returned -22 [ 529.719482][T16144] binder: BINDER_SET_CONTEXT_MGR already set [ 529.725965][T16144] binder: 16139:16144 ioctl 40046207 0 returned -16 [ 529.733493][T16144] binder: 16139:16144 unknown command -746436352 [ 529.733512][T16144] binder: 16139:16144 ioctl c0306201 20000200 returned -22 [ 529.753584][T16146] binder_alloc: binder_alloc_mmap_handler: 16139 20ff9000-20ffd000 already mapped failed -16 [ 529.777740][T16146] binder: 16139:16146 unknown command 10052492 [ 529.784139][T16144] binder: BINDER_SET_CONTEXT_MGR already set [ 529.785883][T16146] binder: 16139:16146 ioctl c0306201 20000140 returned -22 [ 529.797946][T16144] binder: 16139:16144 ioctl 40046207 0 returned -16 [ 529.810967][T16144] binder: BINDER_SET_CONTEXT_MGR already set [ 529.821369][T16146] binder: 16139:16146 unknown command -746436352 [ 529.833731][T16144] binder: 16139:16144 ioctl 40046207 0 returned -16 [ 529.844515][T16146] binder: 16139:16146 ioctl c0306201 20000200 returned -22 [ 529.939082][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:05 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:05 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:05 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x4c00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c633c10"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) 03:36:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) 03:36:05 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) 03:36:05 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 532.246036][T16161] binder: 16157:16161 unknown command 272392972 [ 532.262051][T16161] binder: 16157:16161 ioctl c0306201 20000140 returned -22 [ 532.318286][T16169] binder_alloc: binder_alloc_mmap_handler: 16157 20ff9000-20ffd000 already mapped failed -16 [ 532.328661][T16161] binder: BINDER_SET_CONTEXT_MGR already set [ 532.343490][T16161] binder: 16157:16161 ioctl 40046207 0 returned -16 [ 532.344048][T16158] binder: BINDER_SET_CONTEXT_MGR already set 03:36:05 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) 03:36:05 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 532.369805][T16173] binder: 16157:16173 unknown command 272392972 [ 532.383836][T16158] binder: 16156:16158 ioctl 40046207 0 returned -16 [ 532.384733][T16176] binder: 16156:16176 got transaction to invalid handle [ 532.411465][T16173] binder: 16157:16173 ioctl c0306201 20000140 returned -22 [ 532.426311][T16176] binder: 16156:16176 transaction failed 29201/-22, size 0-0 line 2994 [ 532.435155][ T5] binder: send failed reply for transaction 444 to 16157:16161 [ 532.445467][ T5] binder: undelivered TRANSACTION_COMPLETE 03:36:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x28400, 0x40) r3 = getpgid(0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000000180)={0x0, 0x0}) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r1, &(0x7f00000001c0)={r2, r2, 0x6}) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000300), &(0x7f0000000340)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r5 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0xec7, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNGETFILTER(r7, 0x801054db, &(0x7f0000000440)=""/75) setsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$vbi(&(0x7f0000001280)='/dev/vbi#\x00', 0x3, 0x2) r9 = memfd_create(&(0x7f0000000000)='\xac\x00\x00', 0x4) close(r6) ftruncate(r9, 0x1000000) sendfile(r8, r9, &(0x7f00000000c0)=0xf10004, 0xeefffdef) close(r8) getsockopt$inet_dccp_int(r6, 0x21, 0xe, &(0x7f0000000040), &(0x7f0000000080)=0x4) recvmsg(r5, &(0x7f0000000400)={&(0x7f0000000140)=@ethernet={0x0, @local}, 0x80, &(0x7f0000000300)=[{&(0x7f00000001c0)=""/183, 0xb7}, {&(0x7f00000002c0)=""/53, 0x35}], 0x2, &(0x7f0000000340)=""/143, 0x8f}, 0x2) ioctl$VIDIOC_G_EDID(r7, 0xc0285628, 0x0) syz_execute_func(&(0x7f0000000280)="c4e37d05532f00f0448089008000000dc42177d051002e416f660fe0517bf30fbdde8f4978c2a858e700006740b00066420fd84b32c40213f736") r10 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x40, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r10, 0x40405515, &(0x7f00000000c0)={0x9, 0x0, 0xfff, 0x9, '\x00', 0x100000001}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="2269063e491fa16643722e44c4205452117a8943fd76d5ea54d52233920055b29d08beb8e1f1d64fbf46fc7556db37dec895a3170316376ff2"], 0x0, 0x0, 0x0}) 03:36:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) [ 532.469059][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 532.494426][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:06 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 532.692598][T16187] binder: BINDER_SET_CONTEXT_MGR already set [ 532.700818][T16187] binder: 16183:16187 ioctl 40046207 0 returned -16 [ 532.757304][T16196] binder: 16183:16196 got transaction to invalid handle [ 532.764323][T16196] binder: 16183:16196 transaction failed 29201/-22, size 0-0 line 2994 [ 533.397642][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:08 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:08 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x6000000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:08 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(0x0, 0x0) dup3(r0, r1, 0x0) 03:36:08 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c2fd500"], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x7, 0x200000) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x3) ioctl$KDGETLED(r2, 0x4b31, &(0x7f00000000c0)) 03:36:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) 03:36:08 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 535.292714][T16206] binder: 16203:16206 unknown command 13971212 [ 535.328706][T16206] binder: 16203:16206 ioctl c0306201 20000140 returned -22 03:36:08 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 535.392953][T16208] binder: BINDER_SET_CONTEXT_MGR already set [ 535.415619][T16216] binder_alloc: binder_alloc_mmap_handler: 16203 20ffc000-20ffe000 already mapped failed -16 [ 535.426960][T16208] binder: 16202:16208 ioctl 40046207 0 returned -16 03:36:08 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 535.454970][T16208] binder: 16202:16208 got transaction to invalid handle [ 535.457726][T16206] binder: BINDER_SET_CONTEXT_MGR already set [ 535.493106][T16208] binder: 16202:16208 transaction failed 29201/-22, size 0-0 line 2994 03:36:09 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(0xffffffffffffffff, r1, 0x0) [ 535.493342][T16206] binder: 16203:16206 ioctl 40046207 0 returned -16 [ 535.502776][T16222] binder: 16203:16222 unknown command 13971212 [ 535.532307][T16222] binder: 16203:16222 ioctl c0306201 20000140 returned -22 03:36:09 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x6558000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 535.552504][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 535.573463][T16216] binder_alloc: 16203: binder_alloc_buf, no vma [ 535.593644][T16216] binder: 16203:16216 transaction failed 29189/-3, size 0-0 line 3147 03:36:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$HDIO_GETGEO(0xffffffffffffffff, 0x301, &(0x7f0000000180)) 03:36:09 executing program 4: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 535.608230][ T5] binder: release 16203:16206 transaction 449 out, still active [ 535.620812][ T5] binder: undelivered TRANSACTION_COMPLETE 03:36:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) [ 535.658946][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 535.681329][ T5] binder: send failed reply for transaction 449, target dead 03:36:09 executing program 4: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:09 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x6800000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:09 executing program 4: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 535.907847][T16244] binder: BINDER_SET_CONTEXT_MGR already set [ 535.922140][T16244] binder: 16240:16244 ioctl 40046207 0 returned -16 [ 535.946175][T16250] binder: 16239:16250 got transaction to invalid handle 03:36:09 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 535.984967][T16250] binder: 16239:16250 transaction failed 29201/-22, size 0-0 line 2994 [ 535.998345][T16255] binder: 16240:16255 got transaction to invalid handle [ 536.007430][T16255] binder: 16240:16255 transaction failed 29201/-22, size 0-0 line 2994 03:36:09 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x6c00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 536.549753][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 536.562104][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:12 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:12 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:12 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7400000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:12 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(0xffffffffffffffff, r1, 0x0) 03:36:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$HDIO_GETGEO(0xffffffffffffffff, 0x301, &(0x7f0000000180)) 03:36:12 executing program 0 (fault-call:12 fault-nth:0): clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:12 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:12 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 538.681332][T16292] binder: 16271:16292 got transaction to invalid handle 03:36:12 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:12 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 538.728928][T16292] binder: 16271:16292 transaction failed 29201/-22, size 0-0 line 2994 03:36:12 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000280)={0x2a, 0x6, 0x0, {0x6, 0x4, 0x1, 0x0, '('}}, 0x2a) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) exit(0x9) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000140)={{{@in=@initdev, @in6=@remote}}, {{@in=@empty}, 0x0, @in=@local}}, &(0x7f0000000240)=0xe8) 03:36:12 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 539.365736][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:15 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) iopl(0x3f) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0xffffffffbfffffff, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f0000000140)={0x81, "66502d487a384c144834021ed7f8b254f07baee1de5edbae720c378b48481a1ea7a366ee21256b55de1ef7f22482e1431f2b967f687fa468d6e8016418ca1d7cf0e1328927077bf5fe58d6c93e3c74ce9b1e9dbb098a3c79ef09a6347549905e8d73db6829bfc1b6c287c28d5df2512f8b800702b41b8eed6fe5c1191681bac747"}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:15 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:36:15 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$HDIO_GETGEO(0xffffffffffffffff, 0x301, &(0x7f0000000180)) 03:36:15 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(0xffffffffffffffff, r1, 0x0) 03:36:15 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:36:15 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(r0, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) r3 = semget$private(0x0, 0x2, 0x400) semctl$GETALL(r3, 0x0, 0xd, &(0x7f0000000140)=""/13) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) fchdir(r2) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:15 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 541.791963][T16337] binder: 16335:16337 ioctl c0306201 0 returned -14 [ 541.799703][T16343] binder: 16315:16343 got transaction to invalid handle [ 541.813414][T16343] binder: 16315:16343 transaction failed 29201/-22, size 0-0 line 2994 03:36:15 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:15 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:15 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:36:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x400001, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000280)=ANY=[@ANYBLOB="04000000dc9eb753000044248e9a7a91f66b0000000000f293bc305aace6965fce2d5af1187bf4b31de02b50b4aaacbab3e2e041c87368b8a89c2a129543e075ae0d34792b2b103ab393affff3b74d976e84e20a15983c17a1f0c70476d5dd24e7ad8e422183c9d7cf6300c3bc808200a0716d86d13edc1c8780811b9d69a846b4c42a2abfea2b6e444686cc93f87fcaf9ff421048b5715964d3e4f2d9dfc877675d92019166fe2234df303a51f4bbcfef1e08b66a9a1ee50a6d5c750ab23860a6f71ed90251f589aebf4dd9981643acb1d10fade2f96c6b3f75e87728a174e6049284bb38315cc2dc"]) wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000180)={0x7f, 0x3, 0x3ff, 0xd6, 0x20, 0xfffffffffffffffb, 0x7, 0x8, 0x7fffffff, 0x0, 0x1f}, 0xb) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f00000001c0)={'HL\x00'}, &(0x7f0000000200)=0x1e) [ 541.901508][T16349] binder: 16348:16349 ioctl c0306201 0 returned -14 03:36:15 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 542.024019][T16361] binder: 16359:16361 ioctl c0306201 0 returned -14 03:36:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000100), 0x8) listen(r0, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xb, 0x0, 0x0) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) 03:36:15 executing program 1: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r1 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r1, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:15 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:15 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:36:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x3, 0x2) wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = msgget$private(0x0, 0x80) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000180)=""/1) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) 03:36:15 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) [ 542.431539][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:16 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:36:18 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:18 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000100)=0xc) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000001c0)={[], 0x0, 0x2, 0xfffffffffffffffd, 0x3, 0x10, r0}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:18 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:36:18 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:18 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:36:18 executing program 1: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r1 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r1, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:18 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0}) 03:36:18 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x0, 0x5, 0x71a, 0x38, 0x4, 0x9c5d, 0x7, {0x0, @in6={{0xa, 0x4e21, 0xee3, @rand_addr="65f773a8481b4fd8378145eb174f4463", 0x1}}, 0x5, 0xee1, 0x800, 0x80, 0x2}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000240)={r2, 0x1}, 0x8) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:18 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0}) 03:36:18 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7a00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:18 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0}) 03:36:18 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r1 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r1, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 545.524697][T16442] binder: BINDER_SET_CONTEXT_MGR already set [ 545.531232][T16442] binder: 16441:16442 ioctl 40046207 0 returned -16 03:36:21 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7a31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:21 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:36:21 executing program 1: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r1 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r1, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:21 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r1 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r1, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:21 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x400000000004207, r0, 0x3ff, 0x0) tkill(r0, 0x1b) fanotify_mark(r1, 0x10, 0x8, r1, &(0x7f0000000140)='./file0\x00') ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKREPORTZONE(r1, 0xc0101282, &(0x7f0000000280)=ANY=[@ANYBLOB="030000000000000001000000000000004f3fffffffffffffe900000000000000ffffffffffffffff0901fad7000000000000000000000000000000000000000000060000000000000000000000000000bb68b1e299ce2140b7a7de60e12e1308aea1c7b0f59390c36eb9d7620fedb3537298d53ad7017b919397eefb8c824ce3db631b56d51458a983596b3a2bd88df9a7631fd8b8c4252633f29be9838553327fadd76592c8db2d16e7df2457871d43b98d47f72d40fe95bca6d3ab1947d707b98179ac87894a03f300000000000000000000000000000000"]) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r1, 0x4018ae51, &(0x7f0000000140)={0x0, 0x5, 0x401}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0xfffffffffffffffc, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r1, 0xab07, 0x80) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 548.235670][T16452] binder: BINDER_SET_CONTEXT_MGR already set [ 548.251740][T16452] binder: 16448:16452 ioctl 40046207 0 returned -16 03:36:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7b31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ioprio_get$pid(0x1, r0) ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f0000000140)) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7c31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xf, r0, 0x2040000000000, &(0x7f0000000c80)="4361292904d81f7ec0f85795d43a83e5430207a989689554256ebbde1fcde597636634cb7835cbcb140bdc749720999837c0b62383ed97ed44c272b42e88dbb5440073fc914778a35446521996a2066cf8f61a93679b8c3a0d000000000000a525ee83be49ad404ed79a5b20f167d47a50283d461546e2e1630237dc99870de7eab1cf989ea303147b2324565acd3ea1f55d78768725207c6bde83a11ed85a21c96dfc101816088aaa90dda1af8cd2382a02693bf45cf9118cfa32b16ab99431b57ad99aa61482fd1bfa7e5b6c4a4a65809091f77ff1ff4c74ec8d0a5e380379173738c512d1282fe6d5bfef0cb0fd14ad51949835404c592cde59f4c57c157b982829b7faf95bdf203bd759ae4b58d848a670492e1e30f1c982ec2d497c7ffd71719d1fd924d59def7082fb6c684bb4c0933fe7d2f215e40e0fcde82fd5c5bbfbb8ca11448464d90ff66450180b88ceefbdb4b48c8aa7bd754f39405d7baee15743efc581e4b3fefbd6c318c7b778c3fa8a31bfddb11e52fb7f9f8a1a1f4a323f68547397051bca5fe36ccd6109277831cf4cee2654a5f73419eca3b979b5667f2d82e00e5c0d682236989e58b856749d12cc075e9c7662f53811377c18f518b827f258d74d557dbae14279480d32a5b9c0e45a00e5c0d028c81a4224498a1f179920878386556eec0539b115c95293eed7008502b214987998a950364f46fee13401f066e19a9aa1574e6d1823225fb73fb9975205e12c12cc8cb44c35c7ba595fd6129c045b9fcb570900860def4ed2ba3b970648dce3d4382c76a8891c985725809bdb9a530f41e5c01d3e014dd260b34bf15dd02989cceba46208c926b0dd731b2fc4abf80d83ee9eca48a64537e12d565f0326381c1e22d9c5b3c96cc8b2aa6916aac67873497748215b9831d51f144ceede3c1312f4cfdbbe1442b47bf342c71b484c73ca781dcfc09748e22fb9bca8c41b4f0de86837f75b59891936f1deb969b404ea9689ae033e1694240575faf525af9f844f3e8a60233b2f6451d7541884714b") getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:22 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7d31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:22 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7e31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:22 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x7f31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:22 executing program 2 (fault-call:8 fault-nth:0): r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 549.035101][T16521] binder: 16518:16521 got transaction to invalid handle [ 549.045769][T16521] binder: 16518:16521 transaction failed 29201/-22, size 0-0 line 2994 [ 549.059400][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:24 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:24 executing program 4: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r1 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r1, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r1, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:24 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:24 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 551.346862][T16530] binder: 16527:16530 got transaction to invalid handle [ 551.354117][T16530] binder: 16527:16530 transaction failed 29201/-22, size 0-0 line 2994 [ 551.383494][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:25 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = accept$unix(0xffffffffffffff9c, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) kcmp(r0, r0, 0x0, r1, r2) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ioctl$UI_DEV_DESTROY(r3, 0x5502) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:25 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8100000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 551.532857][T16544] binder: BINDER_SET_CONTEXT_MGR already set [ 551.541451][T16544] binder: 16541:16544 ioctl 40046207 0 returned -16 [ 551.551009][T16544] binder: 16541:16544 got transaction to invalid handle [ 551.559225][T16544] binder: 16541:16544 transaction failed 29201/-22, size 0-0 line 2994 [ 551.571984][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:25 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) wait4(r0, &(0x7f0000000140), 0x40000001, &(0x7f0000000180)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:25 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='reno\x00', 0x3) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x23, r0, 0x0, 0x0) 03:36:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 551.704453][T16552] binder: 16551:16552 got transaction to invalid handle [ 551.712499][T16552] binder: 16551:16552 transaction failed 29201/-22, size 0-0 line 2994 [ 551.743955][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 551.859848][T16562] binder: 16561:16562 got transaction to invalid handle [ 551.876105][T16562] binder: 16561:16562 transaction failed 29201/-22, size 0-0 line 2994 [ 551.896293][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:27 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:27 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:27 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4200, r0, 0x0, 0xc) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:27 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x2000) 03:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:27 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 554.381825][T16580] binder: 16569:16580 got transaction to invalid handle [ 554.396917][T16580] binder: 16569:16580 transaction failed 29201/-22, size 0-0 line 2994 [ 554.416999][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 554.441775][T16575] binder: 16574:16575 got transaction to invalid handle [ 554.453707][T16575] binder: 16574:16575 transaction failed 29201/-22, size 0-0 line 2994 03:36:28 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:28 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:28 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)='debugfs\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000140)=""/214, 0xd6) [ 554.504001][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:28 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:28 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:28 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 554.687782][T16612] binder: 16593:16612 got transaction to invalid handle [ 554.700548][T16612] binder: 16593:16612 transaction failed 29201/-22, size 0-0 line 2994 03:36:28 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x40500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000480)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x1, 0x1b0, [0x200001c0, 0x0, 0x0, 0x200001f0, 0x20000220], 0x0, 0x0, &(0x7f00000001c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x0, 0x0, 'rose0\x00', 'ip6gre0\x00', 'veth0_to_bridge\x00', 'vlan0\x00\t\x00', @dev, [], @dev, [], 0xb0, 0xe8, 0x120, [@devgroup={'devgroup\x00', 0x18}]}, [@snat={'snat\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}]}, @arpreply={'arpreply\x00', 0x10}}]}]}, 0x228) 03:36:28 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 554.862506][T16625] x_tables: eb_tables: arpreply target: used from hooks POSTROUTING, but only usable from PREROUTING [ 554.879710][T16631] x_tables: eb_tables: arpreply target: used from hooks POSTROUTING, but only usable from PREROUTING [ 555.285763][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:30 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ioctl$PPPIOCSDEBUG(r1, 0x40047440, &(0x7f0000000140)=0x7) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:30 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:30 executing program 4: openat$cachefiles(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea', 0x200002, 0x0) fchdir(r0) r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000eed000)={0x2, 0x4e21, @loopback}, 0x10) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f00000f5ffc)=0xffffffff00000003, 0x254) bind$inet6(r2, 0x0, 0x0) socket(0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/udp6\x00') r4 = creat(&(0x7f0000000080)='./file1\x00', 0x0) write$P9_RSTATu(r4, &(0x7f0000000040)=ANY=[], 0x445144e9) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000000000009604000001000000"]) 03:36:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x4000) 03:36:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:30 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:30 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getresgid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)=0x0) getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:31 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:31 executing program 4: perf_event_open(&(0x7f0000000240)={0x800000000000002, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) connect$netlink(r1, &(0x7f0000000000)=@unspec, 0xc) [ 557.500291][T16669] binder: 16641:16669 got transaction to invalid handle [ 557.527325][T16669] binder: 16641:16669 transaction failed 29201/-22, size 0-0 line 2994 03:36:31 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ioctl$VIDIOC_QUERY_EXT_CTRL(r1, 0xc0e85667, &(0x7f0000000140)={0x40000000, 0x5, "fdfe4d54d0f93c408172f749eaf3d640020bed4cfd1e77667a30d90657da7be8", 0x5, 0x4, 0x8, 0xfffffffffffffffb, 0x1, 0x8000, 0x100000000, 0x3, [0x0, 0x5, 0xffff, 0xffff]}) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:31 executing program 4: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigtimedwait(&(0x7f00000000c0), 0x0, 0x0, 0x8) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000080)) ioctl$PPPIOCGNPMODE(0xffffffffffffffff, 0xc008744c, 0x0) ptrace(0x10, r0) ioctl$BLKALIGNOFF(0xffffffffffffffff, 0x127a, 0x0) waitid(0x0, 0x0, 0x0, 0x9, 0x0) 03:36:31 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:31 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000200)=0x14) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) ptrace$setregs(0xd, r0, 0x1, &(0x7f0000000180)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:31 executing program 0: ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000140)=0x0) ptrace$poke(0x5, r0, &(0x7f0000000180), 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) getpeername$tipc(r2, &(0x7f00000001c0)=@name, &(0x7f0000000200)=0x10) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) 03:36:31 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 558.115483][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:31 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x200000) 03:36:31 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f0000000140)={0x1, 0x0, {0x56, 0x8, 0x1, 0x2, 0x7, 0x1, 0x3, 0x7}}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r2 = getgid() getgroups(0x2, &(0x7f0000000080)=[r2, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:33 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:33 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:33 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000140)=0x200000, 0x4) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:33 executing program 4: 03:36:33 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x400000) 03:36:34 executing program 4: 03:36:34 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:34 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x40000, 0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000280)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r1, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x74, r2, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@SEG6_ATTR_DST={0x14, 0x1, @loopback}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x4}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x400}, @SEG6_ATTR_SECRET={0x8, 0x4, [0xe18b]}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x80}, @SEG6_ATTR_DST={0x14, 0x1, @local}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0xffffffffffff00e2}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x40}]}, 0x74}, 0x1, 0x0, 0x0, 0x10}, 0x50) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:34 executing program 4: syz_emit_ethernet(0x46, &(0x7f00000017c0)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "c22df7", 0x10, 0x21, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x3800000000000000]}, @local, {[], @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, 0x0) 03:36:34 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x402, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f00000002c0)='ns/uts\x00') ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) r3 = request_key(&(0x7f00000003c0)='big_key\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000440)='reno\x00', 0xfffffffffffffff9) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000480)={r3, 0x10001, 0xcc250000}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d706b63733120686173683d6469676573745f6e756c6c2d67656e65726963000000000000000000000000000000000000000000000000000000000000000000000000000000000043dee51db2b5582a3a85ab49a6005050f4e7d443fc048f260b4d9e64daaa8b1ae751b19c2ef3637fec82446343d436d3ec32e293e29cef13df6415428b3782d9fe71e5c4e910dc679ca31a77e445340c14bf5d894f111d19c98deda578b3f949cb0cc3a8469e9cb9f87864db1ed1c25b2cff84d6c82c7af69efc8113d43a14740c8d8ed3922cf32434a7ea4d14f4811a9d59cbb4b531dc92582a6c2e49ee5e79fc8b847085bc89e3bd2fa92270dfdc62592ee7176234aa099f978760c44ad32ec23844015885b6fe352c3584719fe7df0572e9fa056649d0a87c61c9710dbadc1231d436ae273cd0fca196d8dc91c692513e8784412d591acab9643c995e7026d8f1ab858d67801808da28b3bd2c7a68c99dbde52944efec331688a329b4b4d2414873d851d085cf39f622cd57a316328211746ec98d6832ac58a644e0d26fb64bdeb8ef40e2759eb2a349"], &(0x7f0000000540)="0b127814cb60f0ab10fc8cc2c7d19bf243640a83ca677cf1ee38ec3992c828f5dac431f5ebeadfeced03fc37b4acfd7fd2cf4072ff839122275be22c6ec7d23a5bcc7a3141c80ad9b7c699c0dfcd2a9ccf7bb694c3b53c5bb31805a58fe6ecd5399542c836925f77b316035acd8cae9cf2848d664edaed21e786f346d20bee8999de9a51dfba4a6f00b5a9891898fb8d117c87bbcb645ef16d59d9499a07ab2b8c4216be7abaf162d64eb4ad4b44c28c9db0819e772fd56a", &(0x7f0000000600)=""/35) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000140)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000240)=0xe8) ioctl$VIDIOC_SUBDEV_S_SELECTION(r1, 0xc040563e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, {0x7fffffff, 0xfdc, 0x3}}) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000300)={'nat\x00'}, &(0x7f0000000380)=0x78) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={r0, r4, r2}, 0xc) [ 560.668512][T16762] binder: 16737:16762 got transaction to invalid handle [ 560.680760][T16762] binder: 16737:16762 transaction failed 29201/-22, size 0-0 line 2994 03:36:34 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x88a8ffff00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:34 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 560.757340][T16771] dccp_invalid_packet: P.type (REQUEST) not Data || [Data]Ack, while P.X == 0 [ 560.770470][T16771] dccp_invalid_packet: P.type (REQUEST) not Data || [Data]Ack, while P.X == 0 03:36:34 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) sendto$packet(r0, &(0x7f0000000340), 0xffffffffffffffcb, 0x5b, 0x0, 0x0) 03:36:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:34 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000003c0)='cpuset.memory_spread_page\x00', 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0x0) 03:36:34 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 561.283421][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:34 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x80ffff) 03:36:34 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x5}, 0x1c) recvmmsg(r0, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000180)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "1bfc97", 0x4d, 0x88, 0x0, @dev, @mcast2, {[], @udp={0x0, 0x4e20, 0x4d, 0x0, [], "e29607149378d33e1db1c73936c77aa3f7fac33b042bd368236862531934ecb1c373d6ea51369e92fb96cc7c6fe4e24d1fcafff87429e50b32881721afab69cc3712c37ed0"}}}}}}, 0x0) 03:36:35 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8a31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 561.467174][T16808] binder: 16797:16808 got transaction to invalid handle [ 561.475498][T16808] binder: 16797:16808 transaction failed 29201/-22, size 0-0 line 2994 03:36:35 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8b31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:35 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8c31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 562.156550][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:37 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000140)={[], 0x0, 0x0, 0x0, 0x3f, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8d31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:37 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:37 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, 0x0) 03:36:37 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x1000000) 03:36:37 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000180)) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) r2 = semget$private(0x0, 0x3, 0x1a5) semop(r2, &(0x7f0000000140)=[{0x0, 0x8545, 0x800}, {0x9c52a530209dc80c, 0x5, 0x800}], 0x2aaaaaaaaaaaace3) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:37 executing program 4: creat(&(0x7f0000000400)='./file0\x00', 0x0) chown(&(0x7f00000027c0)='./file0\x00', 0x0, 0x0) 03:36:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8e31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:37 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) getgroups(0x0, 0x0) [ 564.011179][T16871] binder: 16850:16871 got transaction to invalid handle [ 564.033062][T16871] binder: 16850:16871 transaction failed 29201/-22, size 0-0 line 2994 03:36:37 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x400, 0x0) accept4(r1, &(0x7f0000000240)=@in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev}}, &(0x7f00000002c0)=0x80, 0x80800) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x7ff, 0x220000) accept4(r1, &(0x7f00000001c0)=@sco, &(0x7f0000000000)=0x80, 0x80000) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0xa039, &(0x7f0000000340)="6276449e121f4a2bdf6281cb9d9c046dd4bab74e47331ec7925167fb74b0a05cf37416af9e6a0e4f04e17675ae06d3be7771f90a40e76bb83ea7000865920a08a70f0a070b246adbf914c71217105868cc2ee2df021074220a3fc4e7b6d989d7b5bfaf1870331fee860cd81755edce5abe305146") getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x8f31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:37 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f00000001c0)=0x3, 0x2) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000180)=r1) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) write$apparmor_current(r1, &(0x7f0000000140)=@hat={'changehat ', 0x4, 0x5e, ['/dev/rtc0\x00', '\x00', '\x00', '/dev/rtc0\x00', '^proc\x00', '\x00']}, 0x3a) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 564.213970][ T26] audit: type=1326 audit(2000000197.719:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16876 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:36:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 564.665472][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 564.886327][ T26] audit: type=1326 audit(2000000198.399:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16876 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:36:40 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:40 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0xffff8000) 03:36:40 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) flistxattr(0xffffffffffffffff, 0x0, 0x0) 03:36:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 566.912923][ T26] audit: type=1326 audit(2000000200.419:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16909 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:36:40 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 567.073428][T16929] binder: 16913:16929 got transaction to invalid handle [ 567.090970][T16929] binder: 16913:16929 transaction failed 29201/-22, size 0-0 line 2994 03:36:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:40 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='hybla\x00', 0x6) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:41 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 567.699734][ T26] audit: type=1326 audit(2000000201.209:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16909 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 [ 567.735463][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:41 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) 03:36:41 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x20000000000000) 03:36:41 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 567.914295][ T26] audit: type=1326 audit(2000000201.419:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16973 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 [ 568.020262][T16982] binder: 16970:16982 got transaction to invalid handle [ 568.035872][T16982] binder: 16970:16982 transaction failed 29201/-22, size 0-0 line 2994 03:36:41 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 568.675484][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 568.708906][ T26] audit: type=1326 audit(2000000202.219:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=16973 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:36:43 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:43 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 570.222530][T17011] binder: 17003:17011 got transaction to invalid handle [ 570.231912][T17011] binder: 17003:17011 transaction failed 29201/-22, size 0-0 line 2994 03:36:43 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000140)) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x1, 0x3, 0x10}) write$FUSE_IOCTL(r1, &(0x7f0000000180)={0x20, 0x0, 0x1, {0x40, 0x0, 0x8, 0x10001}}, 0x20) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:43 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) 03:36:43 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x40000000000000) 03:36:43 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:43 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9a31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:43 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:43 executing program 4: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) 03:36:43 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:36:43 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x8000, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:43 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:36:44 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) [ 570.480098][ T26] audit: type=1326 audit(2000000203.989:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=17034 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:44 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000180)={'IDLETIMER\x00'}, &(0x7f00000001c0)=0x1e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000140)={0x26, 0x9}) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:44 executing program 5: r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 570.906908][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 571.053089][T17061] binder: 17057:17061 got transaction to invalid handle [ 571.060585][T17061] binder: 17057:17061 transaction failed 29201/-22, size 0-0 line 2994 03:36:44 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x80ffff00000000) 03:36:44 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9b31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:44 executing program 5: r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:44 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) perf_event_open(&(0x7f0000000340)={0x7, 0x70, 0x200, 0x7ff, 0x8, 0x1, 0x0, 0x7fffffff, 0x4000, 0x1, 0x401, 0xbf1, 0x4, 0x0, 0xff, 0x1, 0x80000001, 0x8, 0x101, 0x0, 0x6, 0x3ff, 0xfffffffffffffeff, 0x9, 0x0, 0x4, 0x7, 0x4, 0x6026, 0x0, 0x40, 0x9, 0x2, 0x5, 0x7fffffff, 0x8001, 0xffffffffffffffff, 0xf13a, 0x0, 0x401, 0x0, @perf_bp={&(0x7f0000000300), 0x2}, 0x80, 0x100000000, 0x2, 0x7, 0x100000000, 0x9, 0xffffffffffff7955}, r0, 0x4, 0xffffffffffffffff, 0xa) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r2, 0x114, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x3, &(0x7f0000000280)=""/97) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 571.266981][ T26] audit: type=1326 audit(2000000204.779:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=17034 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:36:44 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") lookup_dcookie(0x0, 0x0, 0x0) 03:36:44 executing program 5: r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:44 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x10000, 0x0) connect$pppoe(r0, &(0x7f0000000200)={0x18, 0x0, {0x4, @local, 'bpq0\x00'}}, 0x1e) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000140)=0x0) sched_getattr(r1, &(0x7f0000000180), 0x30, 0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) tkill(r1, 0x3e) r2 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r2, 0x0, 0x0) capget(&(0x7f0000000240)={0x200f1526, r1}, &(0x7f0000000280)={0x4, 0x800, 0x30000, 0x800, 0x9, 0x9}) tkill(r2, 0x1b) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x7fffffff, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r2, 0x0, 0x0) 03:36:44 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:44 executing program 4: syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40485404, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x0, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, 0x0) socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='pids.events\x00', 0x0, 0x0) pipe(0x0) r1 = syz_open_dev$vbi(&(0x7f0000001280)='/dev/vbi#\x00', 0x3, 0x2) r2 = memfd_create(&(0x7f0000000000)='\xac\x00\x00', 0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000b80)={&(0x7f0000000140)='./file0\x00', 0x0, 0x10}, 0x10) ftruncate(r2, 0x1000000) sendfile(r1, r2, &(0x7f00000000c0)=0xf10001, 0xeffffdef) 03:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:45 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9c31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:45 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 571.774739][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 571.938507][T17114] binder: 17106:17114 got transaction to invalid handle [ 571.947418][T17114] binder: 17106:17114 transaction failed 29201/-22, size 0-0 line 2994 03:36:45 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x100000000000000) 03:36:45 executing program 5: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:45 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9d31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:45 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:45 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9e31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:45 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 572.624617][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:47 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000140)={0x81, 0xfffffffffffffffd, 0xfda, 0xf2, 0x0, 0x8, 0x7, 0x7, 0xffffffff, 0xffffffffffffffc0, 0x0, 0x100}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:47 executing program 4: r0 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000000)=@get={0x1, &(0x7f0000000040)=""/28}) 03:36:47 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:47 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9effffff00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:36:47 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xfffffffffffffffd, 0x101000) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000040)='ppp0proc]security\x00') ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r2, 0x0) 03:36:48 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:48 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0x6c00) 03:36:48 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:48 executing program 4: semctl$SEM_INFO(0x0, 0x0, 0x13, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value, &(0x7f00000001c0)=0x8) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x10000004e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}}, &(0x7f00002bf000)='syzkaller\x00', 0x1, 0xb7, &(0x7f00000003c0)=""/183}, 0x48) r2 = socket$kcm(0x29, 0x1000000000002, 0x0) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[@ANYRESOCT], 0x337) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000100)={r0, r1}) recvmmsg(r2, &(0x7f0000002300)=[{{0x0, 0xfffffe19, 0x0, 0x0, 0x0, 0x7e}}], 0x2fd, 0x0, 0x0) 03:36:48 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x101108, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) socket$packet(0x11, 0x3, 0x300) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 574.686541][T17182] binder: 17155:17182 got transaction to invalid handle [ 574.732918][T17182] binder: 17155:17182 transaction failed 29201/-22, size 0-0 line 2994 03:36:48 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:48 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x9f31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:48 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setregset(0x4205, r0, 0x202, &(0x7f0000000240)={&(0x7f0000000140)="85f3d2b7d6c4a555c019336ad00db0052407a0971f699f64684611c8042c4a4cecd226ff8bf7f943e50afd3e05f950ba01d36a96c0be85c7514a5359f19f19b44e682c28ae18a66590d37a4c387280ee0654d2b0a657e8da79ac377c1e3d6fc4bd0b6b2c9e38e7b7b000fe049a724912e57dd0f958fd5b39559434e04f73570db212c553c278c047808a6b2a3aad694b3da0f70fb3e370eb13c310c76654f68d96cd4549ea0f2266c0ad5e4f85cad2b25196cb088d5ca039b68f86746ed29b08206972b2e7e02b94524bc93499a98119669822928d53231f", 0xd8}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f0000000280)=r2) tkill(r0, 0x1b) syz_init_net_socket$llc(0x1a, 0x1, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000002c0), 0x4) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000080)) fcntl$setown(r1, 0x8, r0) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) 03:36:48 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:48 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() socket$isdn(0x22, 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4}, {0xa, 0x4e24, 0x9, @mcast2, 0x2}, r2, 0xe6}}, 0x48) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 575.301011][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:48 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$KDMKTONE(r2, 0x4b30, 0xfffffffffffffffd) dup3(r0, r1, 0x0) 03:36:48 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:48 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:48 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) timer_create(0x6, &(0x7f0000000140)={0x0, 0x38, 0x6, @tid=r0}, &(0x7f0000000180)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 575.423725][T17220] binder: 17212:17220 got transaction to invalid handle [ 575.448685][T17220] binder: 17212:17220 transaction failed 29201/-22, size 0-0 line 2994 03:36:49 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x6, 0x0) r2 = socket$inet_dccp(0x2, 0x6, 0x0) dup2(r1, r2) setsockopt(r2, 0x10d, 0x800000000e, &(0x7f00001c9fff)="03", 0x1) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23}, 0x1c) listen(r1, 0x2) r3 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x4e23, @remote}, 0x10) 03:36:49 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:49 executing program 0: clone(0x7ffdfff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) sched_setattr(r0, &(0x7f0000000680)={0x30, 0x3, 0x1, 0x8, 0xffffffffffffff00, 0x200, 0xfff, 0x1}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x200000, 0x0) r2 = accept4$rose(r1, &(0x7f00000003c0)=@short={0xb, @dev, @rose}, &(0x7f0000000400)=0x1c, 0x800) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f0000000440), &(0x7f00000004c0)=0x68) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) ptrace$getsig(0x4202, r0, 0xb70a, &(0x7f00000001c0)) recvfrom(r1, &(0x7f0000000240)=""/139, 0x8b, 0x140, &(0x7f0000000300)=@in={0x2, 0x4e22, @multicast1}, 0x80) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000380)={0x5, 0x7, 0xffff, 0x1, 'syz1\x00', 0x7}) ptrace$setregs(0xd, r0, 0xdb, &(0x7f00000006c0)="d4527c673e1630d2e370") getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000000)=@req3={0x6, 0x2, 0x8, 0x881, 0x9, 0x800, 0x3}, 0x1c) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000580)) ptrace$cont(0x1b, r0, 0x49, 0x0) ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f0000000500)={0xffffffffffffff07, 0x3, 0x9}) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x8, 0x2}, 0x4) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000740)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000640)={&(0x7f0000000540), 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000227bd7000fcdbdf25010000000c0005002400000000000000000000000000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) 03:36:49 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:49 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:49 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() recvfrom$rxrpc(r1, &(0x7f0000001240)=""/119, 0x77, 0x10100, &(0x7f00000012c0)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0xbc9}}, 0x24) ioctl$KIOCSOUND(r1, 0x4b2f, 0x1ff) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000140)={0xf21, 0x1, 0x0, 0x240000000000000, 0x0}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000001c0)={r2, 0x1000, "3fc38ee063b117b88cf93c3cf2f199765cadab0d7496e794c9c5333e7a4d051e6816711fdc95bf5ca3e9b888419202d6af1357e552ed48de4300a229f098cd1f98c83c92722e898763696ebaa82863bcae95a61032917bb65612b0965091a086a28d2d015a83e6becd9aedf9bc404b5ffbd2900248d3688d2dc611e60d8c4d4828f6abad50deb66f74b796a354773118e01bcd15fa22043c1d461f7c7b3be51f0cf53ee6bfae41d001ca9fbcd4d765d2f58a2bb0a7d2e4ecab8ed5f328acd0d19323fa56464386146e4ef4844f450a762ba21dd2660cf89a50b14f0bbac5f48d559c343639f56bf16fd3701dae9a6d5af5121c5fb253a9f649bcf87e815dd986382caac7280acfb5f967b66a31570aeed54b422661a1f81839b95410eb5e292324f9a26ddb23d65778b7af10a35a1d3086310a740404675fc2606bf0622114fd3fe1e29fb35c3d8aa831855b144044d35e797910d5e43b913b2d9020d824cc8c90001e0e4f48c14d99c77a72bbf040e65c9dee4e6fd53521f0ce91c909b71a30a7caacb47dcbfc807e8bd07060d5249044cb439664bc207946767b3d6fca2761778cc41a70d5be3bbebe63827c39e2359be127f41286f6f2c4bebd85a477613d8c6bbc8492f4d02c207ad5c8cbcab5e7df8f0932bb6f4f26f1f11ac019b6fd2ed3458b47208acbcc6c9f135ecc232b77c0baf70ce7c25f32435ffb8e7b773ef6fb19d2b6fe6ffe5d7ed4660dbc0a5da8aaab11a887993d5595b14a9885160f15bfde3c1db0c8cc3b8008293a8bb26b670e2927c0e87c23408f17a76b00ec7673df8e16ae4b6f6ff5062c0d9b9116016da1bbe3041184b5df5abbe7e9dbd7718397ed5addc2ed9dc78a786a8311729a293a3c0d93a536dc8b13cd05f4c0c00ea8fccdbdcae42e31d80ba957d35b0c8dca43feafffa1c6aa408120b5c1082ef5bc59805db6c4ed4483e2b4312465d386d5f61e9cf6abeb8c154e6e54b3141dbf84c3c8e38177f945c38cb2b779c5efd75d101c6e0457fb82fef23161e2551913dede8a3d591072dec3de87946f384bcedd49a05a856a24c7e8128b1b8f99b243376dfea1b7ba289360fce31bcf66e04a348026c97988e25caaec54c78fb98cdbf0cba40257ec0daeaca48a359ade908c3bb7dcb0a329a9631dedd014e4007f3fc003426061b6536d9313003455066d466b85fbedc801f565b8b1ffab8ff96a9d399a4b830c0fe03aaf4711261941e5c547cfd913bb7eba05d680df8955e13a95bf22dca9e9b77b8e5543c2dda84edef095d90742c1cf4c8df439769abaf56f09cdab259e625bde505271067cc9014d025435d391329bff7e80b173d50a48315f17d6152ceb3f6d3926ddc8e10fa454031c22b2175357ac1a36911e7cc130e0207e27bcd0ebd0547c0089c3a1c1b879a957aa2220a11631eb243a5ac403395fad45690ebaca5b296085a6750e98c87ce8de1994f3b33db01a581eb968bf47c81ed69f3daa5c6e590f7c24c11c93596f74ba7fd4d7bec73b349f9dbf4b4f50dbbe5f804324d12df475cfbc012ee1082bf7007afb4f47231586b1f20e8eafcd4563418557b1ec38ff53e48d180c6799561348e5abf40ba64d36d06191aaac2f50fa85250bf7c4844bf685dfaa1a14074ca2a4e94a9d9265dbbb1d6cea2edd95c551d023f0b68e313f41942046112bd0f6ddab898f2aafe711beab0e58f057a073d0994190b0532038c709f81bf6e77ce35a9a54e4a9d2221cf84df3e2bca1d0b3fc00eadf7dfb82898525dfe8f1d7cdbeab637dd7bb71b27a94fd203f85aaf0ae3603d808d8e58e5ab5ced96b7e29d7c035a364050566b6e73faef4fb2922b58701aba7fd166aac8373a70bd6322eaf1e252ef20e410258f05702ae85a471ac6c4e5345bc2ee830a5fe1226312e839b1fb90800dbc98ff6f4dd885bd890c8934b6364ff1bb20970b77682950ddef5901779e4674fd13acf94a93f3854a7c6f47547deede803e11854f9da5a962b893cbc8bb262d6af216ee768e355f38e1a94470da5e649ab53e6d36ecf1da03f344bdb31d7cc10b9b78497f8f393cbd60b956e3077f70c9b3a8f22c005bc3471313c66bba073554c2e0e250e48e88171d82211a27d76fdcd604db0713b0fd08b0b80c148d6082ca14c48107dbe9c79a2e647d78b56891b3a165002cc05049c0887f7f2026cd66a3b73e50dda6642ae76c65b37d70bb990f144d3f00d1c76d60ace77b9a4235ebe506d17c7b905c68797630fcf9c4debc2f91156d5f1e1c54f475deb56c4f876665e44191cca396deb3567e248642216bba624b8567a83fe697058447b297cf8f2cff0ba8b0f953bfdcd25bdafed192112ab3f93de11ce0154e70135692fc6b3c4a6ca1c4df3979aa5e67c64fa1c0cf687a7dc15e3b625e483d496458b4888a03591cf696c8461ddac500c79af1cb62e7efcf1b6d77b850ba0336f62a9b71623ec174187c6f2219667e1a18237ece1ac6b1ad07905aaedf202967825c4b58cc81490333c09cede253eae20d0d1916cc6bebbd38b89a49e05aea473dd258314e5b4ca21270eaddb5df5f3a9fbc88c44fc86bd5bacac16d3813895f2aab6d12bf063621460cc3d00ff3378db8174b98e03dbbad2f69ded98eeb85e6521ba331924a634ac8bead311204bfa370b21599c004e4bec9fcfeaa3a5eb150c2717ecc8281b225d0cf7046e7e278c26e04527d1790f5d7b732e321a6b6e2c7c43e3dde02762150430ebe1bf53a5c6936d84bc7583e1acd66f1b601ac8c829829b1e021ce8bf169dd1f36b11fd754b68e2a8f047a4523f0186e0ee196fbca2e124f393840500b8cb856017b3d9b36627e4a987a4fe26cd309680a04db8c2f01d5d0eea4eb75b8c88b7e2e900e1801d2ac032699cd673677606aad8ec7f6573f9fc01a85d7c7f753f6a837c386adbb93ae20e9c7b2181ee5a44e8136a10cf26300fb668009948b5cc80baf4ff55f211b7044c334829bdc4b0c5d2084dd18b3ff89cca4ac2baa52702e2745c8912919ea63dad10bc355ebd84ae58f0d7ae28d2f1290e8d30063cc231f979352d521bb27043ff23a6591a60f64d1a147b4589f503e08469858fc97c75422c33f8a203d13b4ce030c9a321746cd921cca70e9b03b1e9317c32dbe125c6f23954cd05fe300ccb004019d78ee4cef44b766a7b6ecd90e40b25e9397342fa8d95752a173ce15f90110db597b13f4caa972e1808c1b49c9114703a69a4f0ea7d89173bf39f3f5518791ae0d55f37a26c6e07ce83b61762b608bb0ad26742d1e28a0bb699d072eda819b7d7db79702c17e60888d99e4b1be39924c06839c375203609aad1f170a967fb97146bb4182fd22aa8e701ec6b367cbad9fb5cb9f100b993b12e8b7fac0fc92e3610807678b28b87136137b7057ccbc1c1f6710080e5935c344ecca2d1cdbab65289b7c4976edd104db765e80d5c26152b1409bc2ec0c28b1b13afbd6477779a126c60499c73122fc522b00068f3f67ffa556fd8cd0057ac32ecf209d20ed243ce7d8127cec595ddddf9b81a0b5724b7c96835faebf1c6f9baf5910895add50cdc9ef897efb528bfb0e19843b925436ef23518adb56f378b5682bece5522204d89f41c167b6005dda3e0031c21da731b9602a0ecfd0995d8800543cf1ef90ba64f5f5d1269c9b1d0a47a723bb196e13c9ebdd79445f68c2e9ae23b40c62fc46b3e23e6356959f6c184c26dc20fceb7514a4f6ff73ccf12bb2a8a671f172c69e556af6fc42ff7aa92803093ff79a811728cb390f5b6e33608c07d3df0f2e78b683ce3785f5ac4cda6c6441df3d2e18422b6ebd26c911729d20fa3aa779f12a95a5d55d1cd6cf393cbd8ec9eeeb50141c25ccd11884c7ee76eb9d8b34fa7a6a0063b2fb32d5c7c594784e115c4fbfc1c5f73d5b94458c83fcb0a2f156a8a4f57475e228295f0390bda75ff7f870c76313e916c68740c32e25cb852e46a7f0505733796578c198e900432651dc17f3f539d8065d642dd6e9a5aaaa8df3328ecdab3346e9184baf1550c42fb7410600205308f89d3a00cf65f26fabbb7549b41a8eef2356e17e1f08ebb47a2a4f0dc574434a6a8c8d720e7e30efd7762ac182747d23220afa799a93e1a89ae407f81cd3524f02916b2951282b648190006ec22c1c949682c0122cdc93f91991b880bd681b028a51c3bd57bfbd75198358e9d3add1b37219fea9c6342d2b9118f15ad1bcc8255ba0fc3cd268744f9646c4bfe7f2f77d3dc438a3bd806fbd0f08fb8cc736762fdad2f3412efd88d955083e791b5b36ee92a9a51b236d88c82701723c7b164835b67dfb156b3c426ee24bde4fe841043abf2b605e81e62a77e69534d5d7584ffc8a76e258d703ac3f1256ef0d05282221b028da407724c775463c3eb8b4ca4a41c69687c7581eb0f02d4040abe350ee2cf8720c25534b6100893ff7079deb09a240ae22386187ce43e0670f912fda4cd29c2be443725c586ef009483878b42ded5d20cacb02e81be20cc7e5f798d7484834d3b807b47e22631bb55b19ccd5f608621fc72f8affc6321ccd9e2b8d041c0d30fda8695cc3d7f9abf5b455c558c286ba618dcbaae1f6d5c2130a64216012331c47e3eba78b908748d63e6f30ff1bb2a63d2f96d71e1c6780de081a057dba445750c8af9df969fd1b24455c915d7695abb972b68dc09e8302ce8b735700bc2d82d354ca5e97e9d138d1373e540466c11bd7b0284d08c1b7f31b9fbf4fe7cc02e7cd4caa1e6b7bfa506e969ededb1f6f8d546e66d463d57a769ce4e3ae39402c69ffe58b5815c600f815b1080ef74a04e38fc2cf538906e62ecfe7f757e52e7307b97fcb1171daf495cc8f038669b2533ff049bb2d280702fcf34bc70623f774c6757c79e053ac3ba94ddde627ebd030e57ed4776da6edde2e80ff0f344bc5195f438dd62866a4405c6bcb639fc05e8689ce7fb6e78db3af7fc6c736ca427be491a4eb285f8c8a81c9da1b274773bf24c487714503d2e022175935008b5d83b235765f4c736b0725f9496ec582207044962b1e106f5b7e8370741e190a7310e8afaa6348fabafc3f9bf4295d301f3617ce7f002732d2d770180d811f215b719485447b6db8acb5c0b0fea856e5c607a6d5db1e7ba79744d0f28ee7b1ea05c9b219226f91d45d3c0c8bf8d95ff9f66f06aa650550b7aa74a84cc665a9490332093053de54b57e00fd7b63a5bf4fa7e1b8e9fa0256cecdb0ed4b74c9842bb88b627c1a30c0eff49d5d3f2bac00915065ce0b4e3cc488a153c97be9f9b1471608d8b2f19437b2ceb7671e25988cea3dfe05c7817bff6df6aa84b76bfceb3deca2eaa27e01f2133ffcb3b8b7ff3feaf82fd9155c7fee007b7e9759afc1a3fe8fcbf3f87c8f25b336360bd77272f1e68155e5d20ca5da3c49ad23e39764ebd99e2db1424e946ae437451a8924d9e361ccf9db5a3d761e2ae180be5296685acd5242526fa26ab7b2c35a2046566cc21e4d0e27d1a4eb427bc51446aec918bdd4a00a6ef79e8abc651184600547eb791f609b756b8be8fd5262d03edb077c2060b613e1e9ff2f53e8917bbd8983f4b9adafd44dd0e08c1b5d773604191b12e5971baac986369410b24ab8015bd213a86f4b1818c6ea710524c56f13fa240f5a39e17cdfbdf0c994ea5ea24bef3ce208b8911afc5885c0f7c0c9b4d636f61ce07218a105bf474c9d7148eb4051367f8344e03fd2dafc293f1a1a32e9a7048f0553e26cf64e81d66041bcb717d53785f98fdec0a162dcf3fcdc9114648cc671a74dabaab5296"}, &(0x7f0000001200)=0x1008) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:49 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 575.734148][T17253] cgroup: fork rejected by pids controller in /syz5 03:36:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 576.145621][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 576.293869][T17274] binder: 17271:17274 got transaction to invalid handle [ 576.300938][T17274] binder: 17271:17274 transaction failed 29201/-22, size 0-0 line 2994 03:36:49 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x40800, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x1) r3 = dup3(r0, r1, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r3, 0x40086432, &(0x7f0000000000)=0x3) 03:36:49 executing program 4: syz_emit_ethernet(0x46, &(0x7f00000017c0)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x2, "c22df7", 0x10, 0x0, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x3800000000000000]}, @local, {[], @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "0087ae", 0x0, "ca8345"}}}}}}}, 0x0) 03:36:49 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:49 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:50 executing program 4: 03:36:50 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:50 executing program 4: 03:36:50 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:50 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 577.005443][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:52 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) recvmmsg(r1, &(0x7f0000001800)=[{{&(0x7f0000000240)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000002c0)=""/169, 0xa9}, {&(0x7f0000000380)=""/82, 0x52}, {&(0x7f0000000400)=""/153, 0x99}, {&(0x7f00000004c0)=""/227, 0xe3}], 0x4, &(0x7f0000000600)=""/126, 0x7e}, 0x5}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000680)=""/73, 0x49}, {&(0x7f0000000700)=""/187, 0xbb}], 0x2, &(0x7f0000000800)=""/4096, 0x1000}, 0x8001}], 0x2, 0x1, &(0x7f0000001880)={0x0, 0x1c9c380}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000180)={0xe476, 0x2, 0x0, 'queue0\x00', 0x3f80000000000}) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f0000001940)={'filter\x00', 0x0, 0x3, 0x2, [], 0x1, &(0x7f00000018c0)=[{}], &(0x7f0000001900)=""/2}, &(0x7f00000019c0)=0x78) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:52 executing program 4: 03:36:52 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:52 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:52 executing program 2: r0 = userfaultfd(0x80800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff}, 0x84000) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000240), &(0x7f0000000280)=0x4) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x381000, 0x0) ioctl$KVM_GET_PIT(r3, 0xc048ae65, &(0x7f0000000040)) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:36:52 executing program 4: 03:36:52 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:52 executing program 0: r0 = accept4$vsock_stream(0xffffffffffffff9c, &(0x7f0000003280)={0x28, 0x0, 0xffffffff, @hyper}, 0x10, 0x800) r1 = accept4(r0, &(0x7f0000000140)=@caif=@util, &(0x7f0000000280)=0x80, 0x80000) r2 = getpgid(0xffffffffffffffff) ptrace$cont(0x29, r2, 0x100000000, 0x2) ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000200)={0x486d}) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1b) ptrace$cont(0x18, r3, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x4, 0x10, 0x729, 0xffffffff80000000}, &(0x7f00000002c0)=0x18) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000300)={r5, 0x2c, "b519624ad3f01d2896e690e2030bda3e1656ff3d7a16e2a95000963fed570606a3f28b715c574864160b9833"}, &(0x7f0000000340)=0x34) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000400)={0x17c, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}]}, @TIPC_NLA_SOCK={0x38, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x80000000}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_NET={0x48, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x73e4f3a}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xa86}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}]}, @TIPC_NLA_MEDIA={0x5c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x408a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xe4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7ff}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x200}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffa}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x40000}, 0x20008080) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f0000000240)=0x9) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xffffffff00000001, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, [0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000]}, 0x2f) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r3, 0x0, 0x0) 03:36:52 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:52 executing program 4: [ 578.998544][T17339] binder: 17318:17339 got transaction to invalid handle [ 578.998574][T17339] binder: 17318:17339 transaction failed 29201/-22, size 0-0 line 2994 03:36:52 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:52 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:52 executing program 4: 03:36:52 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:52 executing program 4: 03:36:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:53 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x6) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:36:53 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:53 executing program 4: [ 579.613736][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 579.819453][T17382] binder: 17371:17382 got transaction to invalid handle [ 579.826670][T17382] binder: 17371:17382 transaction failed 29201/-22, size 0-0 line 2994 [ 580.455759][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:55 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000001c0)={0x101001, &(0x7f0000000180), 0x6, r1, 0x4}) ptrace$cont(0x1f, r0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000240)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100100}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x6c, r3, 0x101, 0x70bd25, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x1}, @SEG6_ATTR_DST={0x14, 0x1, @local}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x2}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x943}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x1}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x80]}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}, @SEG6_ATTR_SECRET={0xc, 0x4, [0x6, 0x8000]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) 03:36:55 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:55 executing program 4: 03:36:55 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, 0x0, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:55 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:36:55 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:55 executing program 4: 03:36:55 executing program 4: 03:36:55 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 582.237630][T17411] binder: 17390:17411 got transaction to invalid handle [ 582.252621][T17411] binder: 17390:17411 transaction failed 29201/-22, size 0-0 line 2994 03:36:55 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000140)={0x3}, 0x4) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_buf(r2, 0x1, 0x3b, 0x0, &(0x7f00000000c0)) r3 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000340)={0x9, {0x2, 0x3, 0x7, 0x2}, {0x200, 0x100000000, 0x200, 0x80}, {0x7, 0x7}}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) select(0x40, &(0x7f0000000200)={0x5, 0x7, 0x1, 0x101, 0xfffffffffffffffb, 0x2, 0x5, 0x9}, &(0x7f0000000240)={0x6, 0x5, 0xff, 0x1, 0x3, 0x3f, 0x7, 0x7fff}, &(0x7f0000000280)={0x20, 0x38080000, 0x1, 0x1a, 0x6, 0x9, 0x1, 0x1}, &(0x7f0000000300)={r4, r5/1000+10000}) tkill(r0, 0x1b) fcntl$getown(r3, 0x9) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0xfffffffffffffffe, &(0x7f0000000080)) rt_sigqueueinfo(r0, 0x5, &(0x7f0000000180)={0x20, 0x7fffffff, 0x9c}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:55 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:55 executing program 4: 03:36:55 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:55 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000012c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") recvmmsg(r4, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) write$binfmt_elf64(r4, 0x0, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2f, &(0x7f00000000c0)={0xffff, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e24, @multicast2}}}, 0x108) dup2(r2, r3) 03:36:56 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, 0x0, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 582.874230][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:56 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) mlock2(&(0x7f00003e2000/0x2000)=nil, 0x2000, 0x1) 03:36:56 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x200, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:56 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r0, r1, &(0x7f00000000c0)=0x4c, 0xdd) 03:36:56 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:56 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:56 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:56 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x8, 0x101000) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000180)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f00000001c0)={0x100, 0x1, 0x1c00000000000000, 0x8, 0x2, 0x0, 0xfff, 0x5, 0x0, 0xffffffffffffffe1, 0xeb1}, 0xb) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioctl$SIOCAX25NOUID(r0, 0x89e3, &(0x7f0000000140)=0x1) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 582.989659][T17460] binder: 17450:17460 got transaction to invalid handle [ 583.018109][T17460] binder: 17450:17460 transaction failed 29201/-22, size 0-0 line 2994 03:36:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x1c}) 03:36:56 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x1c}) 03:36:56 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, 0x0, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 583.725522][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 583.826544][T17500] binder: 17497:17500 got transaction to invalid handle [ 583.833707][T17500] binder: 17497:17500 transaction failed 29201/-22, size 0-0 line 2994 03:36:57 executing program 2: r0 = userfaultfd(0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x400000, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) write$sndseq(r1, &(0x7f0000000300)=[{0x1, 0x400, 0x9, 0x1000, @tick=0x4, {0x9, 0xfffffffffffffe00}, {0x951, 0x3}, @ext={0xb4, &(0x7f0000000240)="6108dc148f75493d8270b6a915da4030d7267d552e1acabaea3de27ea7a0ffeda324dcc9e9be0ca2e263e873162c6c7deb26f71fca7c5a7bb47e868a950b56211d8af1518c4e08a8a839ee8ca0b86a449e989ecce68959ea74ee320be54ad2a87e02469f3b8d61c3922014213e914384f5b02292bd6276eb457fc0ec3e8f18c90705f001f42353e0f75c18bb166dc02c28e5feb51254c1be183a3628e68fc10453125b3035e2e748171c88e836d8fd6bc0f2fbe4"}}, {0xe6000, 0x9, 0x800, 0x7, @time={0x77359400}, {0x10000, 0x7fffffff}, {0x1000, 0xfac}, @raw8={"26840e54fae2f22ee8702448"}}, {0x4, 0x7, 0x9, 0x8001, @time, {0x4, 0x1f3b}, {0x8, 0xffff}, @raw8={"fc8ce71668cd721c59862d53"}}, {0x35f53df, 0x7ff, 0x3f, 0x5, @time={0x77359400}, {0x8, 0x5}, {0xde2, 0x8}, @queue={0xf23, {0x6, 0x52c}}}, {0x4, 0x401, 0x4a, 0x83d, @time, {0x2, 0x10000}, {0x0, 0x5}, @quote={{0x8}, 0x200, &(0x7f0000000140)={0x0, 0xca7, 0x0, 0x4, @time, {0x80, 0x80000001}, {0x9, 0xd2a}, @time=@time={r2, r3+10000000}}}}], 0xf0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00003e3000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x2000, 0x1}) r4 = userfaultfd(0x0) clone(0x0, &(0x7f0000000400), 0x0, 0x0, 0x0) close(r4) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r4, 0x0) 03:36:57 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xa931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:57 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:57 executing program 4: mkdir(0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x2ed) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000001fd8)=ANY=[@ANYBLOB="b4000000000000009f000000000036df1b0808f7064c"], 0x0}, 0x48) socket$inet_udp(0x2, 0x2, 0x0) write$P9_RFLUSH(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000180)={@mcast2, @mcast1, @loopback, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffb8fa, 0x83420004}) 03:36:57 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:57 executing program 4: syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount$bpf(0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) [ 584.554619][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:36:59 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000800)='/dev/snd/seq\x00', 0x0, 0x0) r4 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000000)={0x100000001}) socket$vsock_dgram(0x28, 0x2, 0x0) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x10c, &(0x7f0000000140)="f3a47c73832da46586e1c2a2a9d946a2770506c5d48fac6ff371de3a6569e8a83de6ed0878caeb7ca8ff868c5c6863558de55c949b4a35f1dfe1889a8015fe0671512453c7f7fb3034289e5aa13879d03a8661d15693635d2bf50a9e21f55850") ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:59 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:59 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xaa31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:36:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:36:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r4, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r5, 0x301, &(0x7f0000000180)) 03:36:59 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clock_nanosleep(0x5, 0x1, &(0x7f0000000000)={0x77359400}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x0, 0x989680}, 0x0) dup3(r0, r1, 0x0) 03:36:59 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 586.289473][T17555] binder: 17535:17555 got transaction to invalid handle [ 586.301871][T17557] binder: BINDER_SET_CONTEXT_MGR already set [ 586.318617][T17555] binder: 17535:17555 transaction failed 29201/-22, size 0-0 line 2994 03:36:59 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:59 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x400000, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='reno\x00', 0x5) io_setup(0x8, &(0x7f00000001c0)=0x0) io_submit(r2, 0x4, &(0x7f0000000640)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x72, r1, &(0x7f0000000200)="05b0be4ef0a91ab6f8fef27b575e28ce54e2afe0e868d3d35d61c0a235e124f97d8d9ff1dedefda65eebf233c82a4bad63401a69d5aa1ccc4cf5856440e0dc300b4681f6b3c1d95f7541f9c5c05d5c990250129d877fdde437229ed53c24ca64ba9f909866400a0199f3e5b4a4dc795680c75bc15d0de1141121929e87223f1b8112f8d04a5623d253e8a68d03e15b6c198b9d30a03b47b6006424", 0x9b, 0x32, 0x0, 0x2, r1}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x3, 0x100000000, r1, &(0x7f0000000300)="a9eeba8b354ad128e58f8c75bad984340771eccf760b49b373d921c32cbef4aa1b71a6e0bf440dd3a0b5a37a3e90d203acf7ff9544e88408de850c35a54d0e1608ffa6b9579b662f7ebd36cd056aacf0c712c64c0497886c47fc51b627e38987d7e33014875c3e2c15097a80cf9630c6b4484aa12a15f3e6803d68a8e15b99023ac18d2b3524fbd391ac79e91928cccd72dcfe92c3e22a07d57d84c91d9b0bb57c405cd131387764786c8db0202a3cfa2a30aeb55642a08e82d44f4734f96a76843e5a2ed745622a2b76afa879f525f7b8866eba7b26db8f134b20be1488d8f0d4d55631fb8f6684cab6", 0xea, 0x5, 0x0, 0x3, r1}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x7, 0xfffffffffffff000, r1, &(0x7f0000000440)="66bf92fb1f61d55482fd53f43fed1cb0afd3bd7f84149ff0812049b91b5d0d71ff8c3c53df580892948402d810e702b26951ba98af7b030eba35d400ee4690d93a2c1b29f2fa93dbe82cd8", 0x4b, 0xe1a6, 0x0, 0x3, r1}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x2, 0x1f, r1, &(0x7f0000000500)="c14072d97e79d103753168a16bae1526a5fd5a6b1ce74e1bed5e5bf80ff157262ec893e856c6269f7f159afd31d49f849f851a274561d561837e8cfd9d5f11d2afd3d03f8061b24dee93e55caa4d69a5dc3a867d930021cb74c5ebab5bf9664aeb866d5c86c70cf91d89c9d1b69432b2cafde07922513680a54a9775f7e02530679710b5ab17e3d0dbf28c77582f8efdcea9b9cbd682b6e9e408b0e57db86ea5db140d17311faba6d0a7dce57b1f910a3fd70a21443f2cc8d7491e3f8fbd6c455557582f475171fa99fe", 0xca, 0x8000, 0x0, 0x2, r1}]) getsockname$inet(r1, &(0x7f0000000680)={0x2, 0x0, @remote}, &(0x7f00000006c0)=0x10) wait4(0x0, 0x0, 0xc0000000, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x1c, r0, 0x4, 0x0) msync(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000700)='/proc/self/net/pfkey\x00', 0x880, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:59 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xab31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 586.350587][T17561] binder: 17534:17561 got transaction to invalid handle [ 586.361041][T17557] binder: 17534:17557 ioctl 40046207 0 returned -16 [ 586.373897][T17561] binder: 17534:17561 transaction failed 29201/-22, size 0-0 line 2994 03:37:00 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 586.479712][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:00 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x4000000007fffe) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x80102, 0x0) ioctl$SIOCAX25NOUID(r2, 0x89e3, &(0x7f0000000140)) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000002c0)=""/126, 0xfffffffffffffdbf) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r3 = dup3(r0, r1, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000040)=[@in={0x2, 0x4e21, @multicast1}], 0x10) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x6, 0x20000) 03:37:00 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:00 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000001080)=@broute={'broute\x00', 0x20, 0x6, 0xec8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000180], 0x0, &(0x7f0000000140), &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x2, [{{{0x11, 0x20, 0x805, 'ifb0\x00', 'bridge0\x00', 'syzkaller0\x00', 'ip6gre0\x00', @local, [0xff, 0xff, 0xff], @local, [0xff, 0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0x70, 0xc0}}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x7b, 'syz1\x00', 0x9}}}}, {{{0x9, 0x1, 0x888e, 'vcan0\x00', '\x00', 'bond0\x00', 'lo\x00', @local, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @remote, [0x0, 0x0, 0xff, 0x0, 0x0, 0xff], 0x888, 0x908, 0x958, [@pkttype={'pkttype\x00', 0x8, {{0x5}}}, @u32={'u32\x00', 0x7c0, {{[{[{0x30, 0x2}, {0x20, 0x1}, {0x7fffffff, 0x3}, {0x0, 0x3}, {0xbf, 0x3}, {0x0, 0x1}, {0x2dbb, 0x2}, {0x6, 0x2}, {0x3, 0x1}, {0x6, 0x3}, {0xffffffff, 0x3}], [{0x6e0, 0x1ff}, {0x9, 0x2}, {0x9, 0x3}, {0x5, 0x8001}, {0x800}, {0x4, 0x9}, {0x1, 0x40}, {0x9fe6, 0xd716}, {0xffffffffffffffa4, 0x100000001}, {0x3, 0xd5b}, {0x3ff, 0x5}], 0x1, 0x1}, {[{0x7, 0x3}, {0x400}, {0xae0e}, {0xff, 0x3}, {0x1}, {0x7, 0x3}, {0xe05d, 0x2}, {0x9, 0x3}, {0x81}, {0xfffffffffffffff9}, {0x17fcc37a, 0x1}], [{0x7, 0x1000}, {0x6, 0x2}, {0x1, 0xff}, {0x9, 0x7}, {0xfffffffffffffff9, 0x9}, {0x6, 0x1}, {0x6, 0x6}, {0x55d, 0x5}, {0x3ff, 0x10000}, {0x4, 0xfff}, {0x4, 0x4}], 0x7, 0x2}, {[{0xffffffff, 0x3}, {0x3}, {0x4}, {0x1, 0x2}, {0xb67}, {0x2, 0x2}, {0x233, 0x3}, {0x1004000000000, 0x1}, {0x2, 0x2}, {0x3f, 0x3}, {0x81, 0x3}], [{0x7, 0x1ff}, {0x5, 0x7abd}, {0xb96, 0x1ff}, {0x1, 0x80}, {0x1, 0x2}, {0x4, 0x2}, {0xfffffffffffffffd, 0x3}, {0x3}, {0x5, 0x7}, {0x6, 0x6}, {0x800, 0x8}], 0x5, 0x5}, {[{0x7, 0x1}, {0x6, 0xa502562435ae8740}, {0x4}, {0x0, 0x3}, {0x1, 0xe4115d8239cbaf08}, {0x22f, 0x3}, {0x6, 0x3}, {0xfffffffffffff000, 0x1}, {0x5, 0x1}, {0x8001}, {0x8, 0x1}], [{0xfe12}, {0x101, 0x1}, {0x25e5, 0xffffffffffffffd8}, {0x9, 0x6}, {0x3fc, 0x4}, {0x2, 0x81}, {0x7a}, {0x3ff, 0x1000}, {0xfff, 0x6}, {0x1000, 0x8}, {0x2d, 0x400}], 0xb, 0x3}, {[{0x0, 0x3}, {0xffffffffffffff21}, {0x17cff836, 0x3}, {0xffffffffffffffc0, 0x1}, {0x6, 0x1}, {0x100000001, 0x2}, {0x20000, 0x3}, {0xd85f, 0x1}, {0x8000, 0x3}, {0x4, 0x3}, {0x0, 0x3}], [{0x9a, 0x4}, {0x100000001, 0x1d5d}, {0x4, 0x20}, {0xffffffff}, {0xfffffffffffffff8, 0x3}, {0x1, 0xa266}, {0x3}, {0x7}, {0x9, 0x64}, {0x8, 0xff}, {0x7, 0x9c2c}], 0x9, 0xa}, {[{0x88, 0x3}, {0x2}, {0x9, 0x3}, {0x80}, {}, {0x5, 0x2}, {0x40, 0x1}, {0x4000000000000, 0x3}, {0x200, 0x2}, {0x100, 0x2}, {0x8000}], [{0x6, 0xfffffffffffffff8}, {0x6, 0xfffffffffffffff7}, {0xffff, 0x81}, {0x8, 0xdd}, {0x2, 0x7}, {0x9, 0x8000}, {0x3, 0x1}, {0x7, 0x39cbc89e}, {0x1, 0x110f}, {0x400, 0x100000000}, {0x5, 0x3}], 0x6, 0x1}, {[{0x5}, {0x100000000, 0x3}, {0xff, 0x3}, {0x81, 0x3}, {0x40, 0x3}, {0x6, 0x1}, {0x2}, {0x5, 0x3}, {0x40, 0x2}, {0x2, 0x3}, {0x8, 0x2}], [{0x1, 0xfff}, {0xda7, 0x1ff}, {0x3, 0x456f}, {0xdd7}, {0xffffffffffff91ca, 0x7f}, {0xad7, 0x3}, {0x0, 0xfffffffffffffff9}, {0x100, 0x6}, {0x2, 0xfffffffffffffff8}, {0xffffffffffff8001, 0x9}, {0x0, 0x4}], 0x9, 0x8}, {[{0x1}, {0x8, 0x3}, {0x0, 0x2}, {0x20, 0x1}, {0x401}, {0x6, 0x3}, {0x3, 0x3}, {0x100}, {0xd7}, {0x3ff, 0x3}, {0xcf, 0x3}], [{0x9, 0xffff}, {0x1ff, 0x2166}, {0x5, 0x530f}, {0x7}, {0x3, 0x9}, {0x6, 0x7f}, {0x566f, 0x1}, {0x2, 0x5}, {0x100, 0x8}, {0x4, 0x8}, {0x40, 0x10001}], 0x1, 0xb}, {[{0x81, 0x3}, {0x800, 0x3}, {0xe23, 0x3}, {0xa5, 0x3}, {0x1000, 0x3}, {0x4, 0x3}, {0x7, 0x3}, {0x3ff, 0x1}, {0x80}, {0x1f, 0x3}, {0x7}], [{0x2, 0x1}, {0x8c, 0xf6}, {0x5, 0x7ff}, {0x9, 0xc71}, {0x1, 0x8}, {0x3, 0x20}, {0x6, 0x4007}, {0x2, 0x39}, {0x1, 0x6}, {0x7ff, 0xd2f}, {0x1000, 0x12}], 0x8, 0x7}, {[{0x5, 0x1aeb9f4514d23e6}, {0x5, 0x1}, {0x1}, {0x4, 0x3}, {0x3, 0x3}, {0x2, 0x3}, {0x1}, {0x10001, 0x2}, {0x1}, {0x0, 0x3}, {0x2, 0x1}], [{0xffff, 0x8}, {0x5, 0x20}, {0x1c000000, 0x9}, {0xdc, 0x8}, {0x9, 0x8}, {0x3, 0x4}, {0x80000000, 0x7}, {0x2, 0x1}, {0x2, 0x3}, {0x8, 0x1ff}, {0x7d07, 0x5}], 0x3, 0xb}, {[{0x7fff, 0x1}, {0x6}, {0x80000000, 0x1}, {0x4}, {0x4, 0x1}, {0x9, 0x2}, {0x0, 0x1}, {0x7, 0x3}, {0x8001, 0x3}, {0x5, 0x3}, {0x8, 0x3}], [{0x2, 0x1641}, {0x4, 0xfffffffffffffc01}, {0x6, 0x4de}, {0x0, 0x8}, {0x7, 0x5}, {0x80000000, 0x20f8}, {0x5, 0x9}, {0x9, 0x9}, {0x396, 0x4}, {0x5, 0x4}, {0x1, 0xfffffffffffffffe}], 0x1, 0xb}]}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x1, 'syz1\x00', 0x100000001}}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x1}}}]}, @common=@LED={'LED\x00', 0x28, {{'syz1\x00', 0x1, 0x3, 0x7fffffff}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x5, 0x10, 0x22eb, 'erspan0\x00', 'hwsim0\x00', 'bridge0\x00', 'erspan0\x00', @remote, [0xff, 0x0, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0xb0, 0xe0, 0x118, [@mark_m={'mark_m\x00', 0x18, {{0x6, 0x3f, 0x3, 0x2}}}]}, [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x1}}}]}, @common=@dnat={'dnat\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}}, {{{0x3, 0x0, 0x8035, 'bond_slave_1\x00', 'syz_tun\x00', 'team_slave_1\x00', 'veth0_to_bridge\x00', @local, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0xff, 0xff, 0xff], 0xa0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8, {{0x3, 0x1}}}]}, [@common=@NFLOG={'NFLOG\x00', 0x50, {{0x3ff, 0x2f, 0x7fffffff, 0x1, 0x0, "eb3359f5e5d0788460d1200001f8dee0216637ddb90692029415ca7dedd0d1be255845f8fff6934d04b7ffc95ccff0b3b42887f73429c9c7e533e96187fec51a"}}}]}, @common=@dnat={'dnat\x00', 0x10, {{@empty, 0xfffffffffffffffd}}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x2, [{{{0x3, 0x5, 0x888d, 'veth1_to_hsr\x00', 'veth0_to_bond\x00', 'caif0\x00', 'ip6_vti0\x00', @empty, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], @broadcast, [0xff, 0x0, 0x0, 0xff, 0x7dd36d274c084a41, 0xff], 0xa0, 0xa0, 0xe8, [@vlan={'vlan\x00', 0x8, {{0x0, 0x7, 0x6, 0x2, 0x4}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x3f, 0x6, 0xa61}}}}, {{{0x11, 0x47, 0x19, 'ipddp0\x00', 'veth1_to_team\x00', '\x00', 'veth1_to_bond\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @dev={[], 0x1a}, [0x0, 0x0, 0x0, 0xff, 0xff], 0x70, 0xa0, 0xd0}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}]}, @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}]}]}, 0xf40) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000001100)={0x5, 0xb54, 0x4, 0x2, 0xf, 0x200, 0xfffffffffffffffe, 0x2, 0x100000000, 0xf0, 0xffff, 0x80}) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0xb5f, 0x3) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioprio_get$pid(0x1, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$KVM_SET_XSAVE(r1, 0x5000aea5, &(0x7f0000001140)={"ff4bf26be28d77fe1eea8e91db649df519ce79e31b54ce87f0d70b447d12ae0446616df549f80a790989a0a9b169ae0f3ba935ea36b1ed5df92d36d7cdecd07a5ba44885692152632399a8f7ade2093970373df40e594be33cbac9a8ebaf40ce53b5017fd9acc85f48500ecbd78d2195bcee3bcb0e34ad17ded7da5ac776519a990a6f999c02bcc0e61a64b212dbfb09464594c7d52b9509dd265499bb934accb6faf276118964ea8eb7b224200f3c4fb5d35c6572ea459c6510528668d546f7b3be4bbe25742f8d60500563428c9f4aa03b538abd70ac26f909344b6d73e634db396435bbc1ccd82a1fb9a94cc6a066c34b46fed2984e5d27b858875c85bf8e3e3857ed806cb2c2768b9f1664782dfa4031c32aa09bdaa22178a6a2c512bab4026cf62d2e318ebc670fd2c99e5060cde15db52fc1d1aee212534401d075bf52cd258dcad4162c22a9daab34e046f7eac283bc1225e0097df736bbec78a5f7a28c03f764bd35c0e9baa2bc8d94a8f96ae8649405c9353c68406187e59de08f8de18e2111dbbf97700435d11f04f92ed126be9fbf773a59bc6d47222997036a68187f4d2b5d0a8ad824bd2ad0a700359df2b702f48d01f1c98c283469a69830910a7d6e1c0156eb4751c20a93210a14b8a6581378acc776e2c0bad3c95aad185b920d3cffcf76491658fed39321839df4f4f85508c92ccb23b92e3fc7edbd9a525cf1df763ddbfcc99ae4a340fc827b5881b765cb267b7ffe10d904cfe6be64b42543f7ffaefccefea48484928a34d31bf80840095930722fe89c6c298b156105c365bff62811e070db569724327db17b5b29006b69c4422da31944d3fb7618f736b4ef9ea09cdf286785c89650159a117006e612b98bbcb1c1c5e7399f43ac3fcb5559ddfdd4ae45f2e10a394e4cefcb36167858c3c81d919e3a0d9e0bd5738a766e4409e1ca9e7c55153ecf0ca03ddaa055735b85a8edc693ed65157fe8ce8852f436dba056613a199af40bf6c82eed8045497d51ae6ec91e2b1dd10a72a4adc216f2af7a69875dfc246ce5a455b75fa027d4122b6480263cac988f266c4f53eee76e66922d175ada6c525fd62a0c4f26b8575160827762d9ec6b0c1542792e17cd758b405509e04f153c465c850804ef79ceb5705b22c808d8cff1057169ae555d3dfbca26089d4fa245b9ef2c7c25500963918f766e072834ddf4aaf10cf0b3b21781d81c86b9b9432fa84b28705929fadf8f3a7b3f01a00e288da90aca9d7d67331444474824c1938f858900108d9d80851bafabb6c09936e2dbae0d9fbdf0c3e04c6ef0eac76b496eeee503c0360e328169eaeb4796b31102b6750442c9dd98ba30904692a8694f7bfabe7952b6ece6f9ff11ddbfa19ba18091ec86550f7ba157243de81f72ffef4a21ca3844cb6c62d66aead325f5a41f4e04e80fbecf"}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:00 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xac31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 586.698926][T17587] binder: BINDER_SET_CONTEXT_MGR already set [ 586.709636][T17587] binder: 17586:17587 ioctl 40046207 0 returned -16 [ 586.799848][T17601] binder: 17586:17601 got transaction to invalid handle [ 586.810807][T17601] binder: 17586:17601 transaction failed 29201/-22, size 0-0 line 2994 03:37:00 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) rt_tgsigqueueinfo(r0, r0, 0x9, &(0x7f0000000280)={0x32, 0x8000, 0x3ff}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000140)={0x8, 0x810003, "c7db6cf174a3665da6ab6607289649c2cb8e693376897ed8", {0x80000001, 0x7fffffff}, 0x9}) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getresgid(&(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) getgroups(0x6, &(0x7f0000000240)=[r3, r2, r4, r4, r4, r2]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:00 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 03:37:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r4, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r5, 0x301, &(0x7f0000000180)) 03:37:00 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xad31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 586.985455][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:00 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 03:37:00 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4200, r0, 0x0, 0x0) tkill(r0, 0x19) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x2000000000000010}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x2, 0x0) 03:37:00 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) [ 587.173392][T17631] binder: 17613:17631 got transaction to invalid handle [ 587.184288][T17631] binder: 17613:17631 transaction failed 29201/-22, size 0-0 line 2994 03:37:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 587.394021][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:37:01 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xae31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:01 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:37:01 executing program 2: r0 = userfaultfd(0x0) ioctl(r0, 0x0, &(0x7f0000000240)="38c75e94aa1ab77c5216233cbe1784a48a10ac6c3c6134b7b1417d37179a449b2db1ab396d5d074859ab800b9f8bcea44fdddfb9088a0ca21fa60d21ac1b787788c917907d723deee344b71835b4076a0f138d08aa45314f68c8e9f047489f7e4cf643e4380738ae9cf473ce855278c4b316c39aa8e016e413dcd3e4cfb9313b8e4ee1052bfd541b209506e71ea24d6ad0a054040127c9164290da5c9c5f204c236a7daa2a9e2d9a9a6281937ba355f907029c2f72e7e6e09f196cc5f7511761ce375eb7d1a34ec8d78b61962498b947d224afc960e9e88517d227f7b1b761e706") ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:01 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x200, 0x0) accept4$vsock_stream(r1, &(0x7f0000000180)={0x28, 0x0, 0x2711, @reserved}, 0x10, 0x80800) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 587.462702][T17637] binder: BINDER_SET_CONTEXT_MGR already set [ 587.469596][T17637] binder: 17636:17637 ioctl 40046207 0 returned -16 03:37:01 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) [ 587.527294][T17649] binder: 17636:17649 got transaction to invalid handle [ 587.544250][T17649] binder: 17636:17649 transaction failed 29201/-22, size 0-0 line 2994 03:37:01 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:37:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r4, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r5 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r5, 0x301, &(0x7f0000000180)) 03:37:01 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000800)='/dev/snd/seq\x00', 0x0, 0x0) r4 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000000)={0x100000001}) socket$vsock_dgram(0x28, 0x2, 0x0) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x10c, &(0x7f0000000140)="f3a47c73832da46586e1c2a2a9d946a2770506c5d48fac6ff371de3a6569e8a83de6ed0878caeb7ca8ff868c5c6863558de55c949b4a35f1dfe1889a8015fe0671512453c7f7fb3034289e5aa13879d03a8661d15693635d2bf50a9e21f55850") ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:01 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xaf31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 587.835544][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:01 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000800)='/dev/snd/seq\x00', 0x0, 0x0) r4 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000000)={0x100000001}) socket$vsock_dgram(0x28, 0x2, 0x0) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x10c, &(0x7f0000000140)="f3a47c73832da46586e1c2a2a9d946a2770506c5d48fac6ff371de3a6569e8a83de6ed0878caeb7ca8ff868c5c6863558de55c949b4a35f1dfe1889a8015fe0671512453c7f7fb3034289e5aa13879d03a8661d15693635d2bf50a9e21f55850") ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:01 executing program 5: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = memfd_create(&(0x7f0000000400)='\xe87y\xd8\x0e\xfaE\xbb\x7fH\xbe\xbc\x95\x87\v\xd0\xcd9\xbd(0\xeeG\xaf\xe7\xb3?\xc7x\xbd\xe2R\xc5\r.', 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000000800)='/dev/snd/seq\x00', 0x0, 0x0) r4 = dup2(r3, r2) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f0000000000)={0x100000001}) socket$vsock_dgram(0x28, 0x2, 0x0) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x10c, &(0x7f0000000140)="f3a47c73832da46586e1c2a2a9d946a2770506c5d48fac6ff371de3a6569e8a83de6ed0878caeb7ca8ff868c5c6863558de55c949b4a35f1dfe1889a8015fe0671512453c7f7fb3034289e5aa13879d03a8661d15693635d2bf50a9e21f55850") ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 588.041312][T17681] binder: 17673:17681 got transaction to invalid handle [ 588.056550][T17681] binder: 17673:17681 transaction failed 29201/-22, size 0-0 line 2994 03:37:01 executing program 4 (fault-call:8 fault-nth:0): clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:01 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 588.224174][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:02 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3e0e, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f0000000040)={{0x2, @addr=0x632f5484}, 0x8, 0x4, 0x8}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r1, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r1, r2, 0x0) [ 588.725530][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:04 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4200, r0, 0x3, 0x6e) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000140)=0x1) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:04 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e24, 0x7, @remote, 0x2}}, 0x8, 0x2, 0x20, 0x6, 0xd04d}, &(0x7f0000000040)=0x98) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000080)={r2}, 0x8) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000140)={&(0x7f00003e1000/0x3000)=nil, 0x3000}, &(0x7f0000000300)=0x10) r3 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r3) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r3, 0x0) 03:37:04 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:04 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) getpid() setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:04 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='veno\x00', 0x5) ptrace$cont(0x1f, r0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000180)={r1, r1}) [ 590.695490][T17728] binder: 17715:17728 got transaction to invalid handle [ 590.702529][T17728] binder: 17715:17728 transaction failed 29201/-22, size 0-0 line 2994 03:37:04 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:04 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:04 executing program 5 (fault-call:2 fault-nth:0): syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:04 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f00000001c0)=""/2) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000140)={0x7, 0x3, {0x1, 0x2, 0x0, 0x2, 0x1}}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:04 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 591.353989][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:04 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000180)={0x20000000, 0x9, 0x200001f}) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:05 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x2a}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x101, 0x28002) setsockopt$netrom_NETROM_IDLE(r2, 0x103, 0x7, &(0x7f0000000080)=0x33858ffc, 0x4) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:05 executing program 5: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x100000000000000) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:05 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:05 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f00000003c0)='/dev/admmidi#\x00', 0x9, 0x2) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000400)={0x0, 0x7, 0x10, 0x2af, 0xa95a}, &(0x7f0000000440)=0x18) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000480)={r1, 0xff, 0xfffffffffffffff8, 0x1ff, 0x609, 0x8001}, 0x14) r2 = syz_open_dev$binder(0x0, 0x0, 0x800) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x12}}}, 0x200, 0x5, 0x7f, 0x0, 0x2b38000000000}, &(0x7f0000000380)=0x98) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f00000000c0)={r4, 0x5, 0x40000000003fc, 0xa00}, &(0x7f0000000100)=0x10) socketpair(0x4, 0x2, 0x80, &(0x7f0000000280)) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000180)={r5, @in6={{0xa, 0x4e20, 0x2, @ipv4={[], [], @rand_addr=0x80000001}, 0x60a7dfee}}, 0x400, 0x101, 0x5, 0x7f, 0x5}, &(0x7f0000000240)=0x98) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 591.634626][T17833] binder: 17757:17833 got transaction to invalid handle [ 591.665538][T17833] binder: 17757:17833 transaction failed 29201/-22, size 0-0 line 2994 03:37:05 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 592.305359][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:07 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2, 0x0) 03:37:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) signalfd4(r0, &(0x7f0000000080), 0x8, 0x80800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:07 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:07 executing program 2: r0 = userfaultfd(0x802) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) r2 = fcntl$getown(r0, 0x9) move_pages(r2, 0x7, &(0x7f0000000040)=[&(0x7f00003e3000/0x3000)=nil, &(0x7f00003e3000/0x3000)=nil, &(0x7f00003e1000/0x2000)=nil, &(0x7f00003e1000/0x4000)=nil, &(0x7f00003e4000/0x2000)=nil, &(0x7f0000fed000/0x13000)=nil, &(0x7f0000ff5000/0x4000)=nil], &(0x7f0000000080)=[0x800], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r3 = dup3(r0, r1, 0x0) ioctl$TIOCCONS(r3, 0x541d) ioctl$BLKIOOPT(r3, 0x1279, &(0x7f0000000000)) 03:37:08 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000280)=""/89) ptrace$setopts(0x4206, r0, 0x0, 0x0) syz_mount_image$gfs2(&(0x7f0000000140)='gfs2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x7, &(0x7f0000001540)=[{&(0x7f0000000300)="8c67f9e37c0ac6f8880802235b2a995d28458b498b88d22887eae1d1fd0f20553d3a5e36c5f128865ef85b9263a482113ace9c2b51f4f8562a3c6e60812ffd95e526bf196e6bf346ea581a1516294fd95df8cace845952518b8f1da7313533e8a41772fe2022edb216408e02be1c97ed437adae965787f327f50521a2866029524865f7156ae5fcfbedd201fb72a3b7f34606674749bbf8ca153402717c02138a92982a62e9822170728149e7cc3effe8d8de7e2a3a35a63d8cd27aa89e4362166965abe86fdc0f68dc6174ee32cdb9d4396b0177d0aa105b7edf267d810e40f93a1c759d2c33f42139c64443a3d22ea4ed0d90b3a56f4bc4c8dcd4243d7a153b201e2a98dd648546560cbd28b00bcda941154a4b7fdccad382d0bae040a52f9c8bba24f40e0cde7397f1f20c2223d3e437d99e00f6a8296083f1c40807c9adae9c5ec8d7fb24f16fbe9d07398ebddcd9a54c22ece3b7a5e1c5442c9e798e5a3ef041df5fa017a350ac6436afbf8083ad0505e8a10760044a11d63299903e28c1249813f3aa2247ea488b7ea85003813ee8e1834c77b9e295ccb7966e96be7808786befc2107b5c264920e4599d1a81e0fbc44d09f8437b5797aca9f1f39ab5480166a657be5f360a441d8ffcc6eec521cdaf0113357ea7c10e36a936de7b8e937a7f5980745018289910c5f1abf30f253ce17426fa3067082f2f676b093efe1f35522f040aa33a7f69c9cf4cb58afe1b632c42530d2f756372af37ca24555f9e684a40020696ce1c594894bffc920f798c3a909574126edf9b4fc4b043656415629c3b379b5a5e95d336c0bed927810bdd87a049f5a3df055f35f9c426b786a3493383f39953403671e789ef481f50ee87a4ea87dcd290120eb9841791b4d45752e86237b38fd5f3dfcb0c7ce1c141d5baf74d23433f94fbb12e8381a83951d3aaea8879fbbc2898276e0908f38444578525543567459415282393f7accb94c3681bb65f38d374df5087d89bcb726efce5a00d0ddfb1773b1f75b0166ce0411d87c4b47bf9226a959310221bda966ed499d1b6a33c6d1a3d5c9b824203bf8da1bd57546da91bb0e989791733a9f927c6fdb38c6939b0d0b751e4625d90279167710f14a23f0c8841c4f78d7a87ee39890969b220ac26f24ceb7fb615be4d8b399601c7ccd96833a8a5df836882621a4122f35fe096e71f1762b75afe28fe52a11a08207dae8aea35020c6ea9dff450c7b8938ef3c05426c3173cd7ca8477abeca8bca8e884ab463813f0c5b63b75a91c20e0f968efecf059e5a3c304368f6fee2473df4848449f5388b858124f8503072fddd76c21a19deddc540c82875db344996474f44d1a9630796ed35378307899c940bcbdcf4d1d86b5932168c9f433938509a3b72027abbfb68e2e1029ee2f39ff1b113c35ebc8374d397ec8da429ee73089a3d72e9893635e40e52f5c85a079760a515ca114635896337b0ace5f31293d940b4ab86fcb24c4e1e1294c55596f1682224a20d6dd96787e2e6be60671b3f862fa2670b44f8b5db1716218cd62b82b1a28b20d307062d81d4a9ca780715f9341f76a83d16688d121f410891709c5dd5c6b2d9d13ee6cd449c6830f2f82c9120895959a9e60700babecd45c93f1381749521d0af38ae177d8b1092b9f9b0bb86c1894b33e82c390b652ac2bc78b4d65d4bdd4ec2749fe89728c8ec9d6284c3aa3c160cf61e81fd5563354a1e84c4ae983ec41c6ed3ca4f9fd7665185c97cb822b88604d9530fd51b200032a1bc9ee8ac22ce6f6c5135cde4a1fc6498bc1ca1477850ce85e73ff955632724d1e9a240c84bf1b1cb2adcb86e23891eaf14908852c599a2025f3b3d06edf368d2d4c26d94aa1eafc2f9ada9a85084e198d62e133cafe2b7c8b6c60a6aa89f8f244eb0b95bf0626938af1ac26eff37521966f201f8f77d1ddbe2a09ebef40e485df576f132fab311b6498c86d438f84382a8e7ad4e20e9a3a2565b35451b45e7148a88c32d42941bc8cdb5bffc1c19b11e7cd9749ef062b853e9c30c10b41436b35d0be0f084caf7bd255e57afbb48b9a8e78a54586426c5fd65c5bfaf82c6c832a9de0dfc9a791b4e624ff4cbd20c7cc5dc4e507826c70fd1d1550a5bfb3a1eab178c8ac7b84785d3dff26a124c6368289f9fe626a1a752b86189c05365c5f4b5c82f197ebe3a6be864c5043a1e8b9c00063339871890c35b2f3272a5a45b0c2539b025931ea18d74daca94701c7992ab0b0c1207d01c202a7ef4158c8a5223c38b751fc4507341734b2a99a2563544b912c1b95499624cf36fe4fed1c0f4ffad20fd52a70dc28e64106b03d56fa0f43c6f885032e6a5390e6896dba4e6ccbd9918994fcf73c2f6107bbee2172cdaa64e30ca0ef2cfa9a05fc18390d6133da68849ff8b162a1036bf5a1744e0b97f8d3ec9573f00672c080e26b37177f0c3da294444601a0b3ef804e3330a5c18b3b8c05f3afe9755f3220256630ab29817d5bcd95ec2e59af676487fe9d2956c8df3175cd2124b50047b6dff19fed03c0f1fe1dc76fc3103ef6ac7574a20e91c526257398cda5694ca318969621a676f68aa21c5b4cb784c35fe96257ed1490cf5e1d6a2f1d3de1a237be084b0e6b5704f1b4f4af4b935d53f88715f4cd9b788eeeae0e02dbd98151ef828b2457ffdc97b072e5c538a04464a2e76cf2852225adfa3133ea8501840b0c4eea04e72f1c8d773c8ffdc1dfa50956833bc123e2c29c76594c72cd6ffb22a8badd786298bb7bbfef4ffe926ff5539e24f7a83f28f0d65570c7a4af7839348ec185ff8d538ef02dc82b5ba893ab379e2519bad88aa7034458211f1938003aee04e60197825a2ffc743492267402b70bcefb7155f26cc4a3552954dfdb348524a600b8bfa87aaa34151223dc3971648c2a1cc57c8b918f5b7066b31ce6158c9edd08d17f9a3afe4850c35478874cfb01993d95e2dec73eb2e876f152df23f5c07d0eb2fdacd842aa1f8622cb98c269ff65bd3efc23218d977baee301b5adc28f7eafa209f3e7d7da3b30ffaab7bd380075cedb7809d88667c0d6195dba39409a65da942cdf67d6705ddc4643c6fb9cd259fb934be8f6a5b827fd512e4ed1770bfe628d29ec87e4c8bf10ae7f02772f39ed7d8712880c0fb7511b6b83ebf61a12d52337854b3840d12770accf2044522acfd8463cd45d9e33f4c0a06ed6fe0ec874be776526e762dcd5e1c61c10642fabf5c0d4331a5ff484df70e581437eacbd07d7348ec736472d27f51206328c37e12a4774f6cb40637e10ba9623d2ac41e56e9543eceb87df21ffc4bcb4bda9f50ced1039774115668a5e44733dedd68f2b270f6e410c60449a707e532fbc7e9b6a487b9bec5465a7841fdcb74780991a10cf674d1bfff4138ba5431eb621f4a47f04f341b09bc91e0d4dd3fe9503f46040a70be081eef06338741c12d0d27d993a0cbdc7a8bdaec5f3da7ce9842569235aea9509fea2fde86aacd738f47ba2ca0e11f32018927b7692c6b1ec77f05456b1c511c576ef2fbc829d26441bd840a9018fd7a869aaf92282050205ae432b50a104c4bf654961c4cab3e2928003d054920435e26a27b36dbc2958af3617431cda897e336cee860fe3c4de134576a71cd1b4a0165d8f9d8bb7f4cca48a3f770b097729d4d875bb6e3b996c6339df0a3a770f196dce83fecc37531eede4c4f89809f2eea7cbd16101dabee06af740a4e25e26a85560add103a9b3d54e3e5431a3316af13b34670e99bc9643a8f0b8e515443d94e3c8bd8f5f93f2685004cbae838177d672dbeb8a016ec0a25c75e20f06097e3ceecf592db34baf756ef1f4d84e0638cfbb74710058d589fd4872469f68890819812d20308564199fd8fea24e2248adc3fd23f06a55b1d3b65c94353864cc80a089df5f75877d58b6740e4528eb0eec13f487d18169805e5b55dc99e00daaaca810a85bff29fcb81500d1518adc52f4815fdee21c7c1cccc7c7b1ad368cfa480080bb68fe3d610f3051ff4b80c9e1f4ec255185c06eb338919bc4de9191cad1bd66b92613ef62fc49cb3a37ddd2bf35768e84b5e6db9229292b0e48e4a48ddac711c21bd5f5e15ba461be75fd61ea355b271c96f4fe3baec5db80ba9c12dd88eff7f674da7cba673c677b9d0ada83d97171df409cb14f68af2d1daec0bb7091a14db3f142046fb343d04a5c713a2d08ec7dfb2f9dc833ba02951b6090328681d4bc1fea288478a24144c91b60b037f04535812143bc3ab72845fae356bd273bff8488ed1e679385c25b6098a5790bd8613278cfc2ae0b997b87568bee52e7bcb3ccb2269775340d37df7b45bd4ae84fa696b3964469c6c3f1198c741b98fe462499e25a68bf42dea93fc81603f8521c1d877feb1570da87534c2a4fe49259c99d55d05ab85273c54e3feef02f32a69f8122b01aeadea3458ec9df0a8c6fd6e517d0b63823a2f4ead85f424165cf2e0c0e3400482bb9cabf7ef9e85592cf168a4bb8b6ba22bce30843501af7c5958a075db87db1e3061626ca664685d771d9ad374ff5ce1cc4046e4693e21636dabe5f496d2f24f32cc3502e3b20ef3ecf50d55e5d2bdc33477c090830f94d13d1ad87bd19131e83d52abc5b320dbe30a4edccd41de30070d7be93072d11a976d8250daedb7012fe7d2845d2484d6f9eaef738c7308b96830e4d70f86d8c2ec9f49bb778284db28f6d0f3145ba261aae464301c0d3c6e42ba87356acefbbcaa65446c243589a4ca01a82f92b4d74f07ad078f295ece6e57292d9810b5191432ae37e6dbe152751b438a0df1b1ad9cefdd9ef4ea0398ebf44e796c856502b69e6ef645844f6c2c2b4306fbcb299fc88de50173e8cc99cfe858cc8fb117e35791f84b3f2bfad3e8728e5f57494182eac998067476e06de819146026ff1f49e146886a7502bcc05ec99aefd2d9954ecd6bac4a575710b88f51ae48867c1dcb11e4118f4bc0c7af410ca7ee641e488fb956fe15a8d7fb39dfd8b3e4c5723d6cf0888b47e6f3ea35e7fb1c0306dc024cbe254e779d64b62ccc2276e307c261c94be99cba7e3b6c260295eb6c8401613de1c615076606388127636f81f40761ec586cad636983751f50aa0565f9baca7d31287dd903656cc35a8b443a045548be61a6986a8ea250ebca9837e2c451861dd7fa612a0223a604bbed6f845e8ae96509719e61995e553cfc3190bab87d1e2d436f2d52598f237412b71f70f18fc7aa00071206c34b5fca4b27f60141c473bbe2a0b694e51488ff7e6d9acbb33b483185def401ff87a1e21c950449b8129c0ff2a844f7bcf20e204298f8e99c58cdb9642a5e8c0a3b97153a4bed5940751aa3243ed57a34064b33516ddbd773991ff80b12af9e8b835fd658103a16506cd6a6ca67a6261b5bf34616b43c62e86f1b23b02bd0336b3436a97cffeeabe5ea7470bc37dfaa10630d29e9370dacfc0811f60f1ee0ed823798696964b51b46a8273ccf63ba8a31ab62a5265d25ef966c8ce4149eabcdb4f01c6ef3425dc89729d91fb84b960cf701ab0a54fb7d0ff24b2a480976431ca285a8812cb2bd6299b92d4a10edd6cf7ea79ac47eb6b8c6258779dbd7a9b49a768e18c83e14604f03a66617b2ad0ea2302219cd2274548f12f6dd88ee91d79d6fc767fe1ac2f7a7bd65e8e520627ce8ec021f8cd66a0e70cf1e1453ad609f8a7b0b5f3a4b869ff4b4c5f795474a2cd174d6d467fe93177d0a575971351c8a15a62eda33a6e0cc3321b51b09c1a41924156cf147f06c70601570b5b8", 0x1000, 0x1}, {&(0x7f0000000200)="b1a40f3b7dbee98f5c75288b7cecc6", 0xf}, {&(0x7f0000001300)="cec72b6bd8124f36902571ca4597ca4d0d3488c57e7177421d497b8d841418c55baba07e1be14aa142612ccc98b84b0a621548326a1ce8906925658af9f32408550514476427aea04068011154890b0f1f7ea922", 0x54, 0x1}, {&(0x7f0000001380)="6afaa685b7be514052f3c7eb6e841bb281ef04aa035482b7ffe3527253834e64a54b64c8be4a189c45800de466595719e09814b5834fbbdac115cb23eb8a475532a6cbf156bec31647423f1bbe6725c7eeee4b58c3dbb3f9199f7f71f26bf791837c70f89c5951ef1dd4a11f8ef49558417e133b11ecb06f2a2f2d59a140ab806e69e6a1e7b5a618abb74f0eddf5b62873b280a861314a8d0e37f85eea089b416709372214eee8806422912711e88488eb41", 0xb2, 0x1f}, {&(0x7f0000000240)="64bd1168990bea3ea2ddfc", 0xb, 0x9}, {&(0x7f0000001440)="7c339ae7642adf7f6c81c6fb7162f8ffdea54a9be7bc6876db96817d681498e77f140a4fff6ab05ce8ff1678558d11e5aeec6509224a982aef0c00e1ba446f349ab77a5a913775e9714882ebb599ee499473b21e0ed41849ae2137a81b5145b4b14be68e7e6a1c135456109df08b62dfe3694a650ae11e2cc66b5e5f6a97f8d5a9ece00f5ff1db", 0x87, 0x8eb7}, {&(0x7f0000001500)="4a4e67c9220177762a873167be8552bbfa37ea9422a5abfc811136a2c394e383a74f1f0702cce9892036922d48", 0x2d, 0x31}], 0x40004, &(0x7f0000001600)={[{@suiddir='suiddir'}], [{@context={'context', 0x3d, 'staff_u'}}]}) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f00000001c0)={0xf000, 0x100000}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0xb31, 0x3ff) ptrace$pokeuser(0x6, r0, 0x7, 0x7) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f0000001640)) 03:37:08 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x1b54, 0x0) 03:37:08 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x2, 0x472003) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000100)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@local, @in6=@ipv4={[], [], @initdev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in6=@mcast2, 0x4e21, 0xffff, 0x4e23, 0x6, 0x2, 0x20, 0x80, 0xb7, r1, r2}, {0x1, 0x4fa2919a, 0x2, 0xfffffffffffffffc, 0x8001, 0x4, 0xa7c, 0x5}, {0xfff, 0x400, 0x1}, 0x57, 0x6e6bb8, 0x0, 0x0, 0x3, 0x3}, {{@in=@remote, 0x4d5}, 0x2, @in6=@local, 0x0, 0x3, 0x3, 0x8, 0x4, 0x7fffffff, 0x100000001}}, 0xe8) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:08 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$SIOCX25GCAUSEDIAG(r1, 0x89e6, &(0x7f0000000240)={0x5, 0x80000000}) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$PPPOEIOCSFWD(r1, 0x4008b100, &(0x7f0000000280)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'nlmon0\x00'}}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) migrate_pages(r0, 0x8, &(0x7f0000000300)=0x9, &(0x7f0000000340)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000001c0)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000200)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, r2}, 0x14) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000140)) ptrace$cont(0x1f, r0, 0x0, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rfkill\x00', 0x183200, 0x0) connect$unix(r3, &(0x7f00000003c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f00000002c0)=""/4) [ 594.596353][T18114] binder: 17995:18114 got transaction to invalid handle [ 594.630200][T18114] binder: 17995:18114 transaction failed 29201/-22, size 0-0 line 2994 03:37:08 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2154, 0x0) 03:37:08 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:08 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='map_files\x00') ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000180)={0x0, 0x200, 0x3800000000000000, 0x0, 0x9, 0x3, 0x80000001, 0x0, {0x0, @in={{0x2, 0x4e21, @multicast1}}, 0x8000, 0x1f, 0x5, 0x101, 0x3}}, &(0x7f0000000100)=0xb0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000240)={r2, @in={{0x2, 0x4e23, @broadcast}}}, 0x84) 03:37:08 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={[], 0x10001, 0x5, 0x0, 0x2, 0x4, r0}) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:08 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x3f00, 0x0) 03:37:08 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x0, 0x301040) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000180)={{0x2693, 0x4a6}, {0x0, 0xc3}, 0x9, 0x4, 0x1f}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x200, 0x202000) setsockopt$rose(r2, 0x104, 0x3, &(0x7f00000000c0)=0x5, 0x4) 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(0x0, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 595.190622][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:37:08 executing program 2: syz_open_dev$vbi(&(0x7f0000002d80)='/dev/vbi#\x00', 0x1, 0x2) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) lsetxattr$trusted_overlay_upper(&(0x7f0000002840)='./file0\x00', &(0x7f0000002880)='trusted.overlay.upper\x00', &(0x7f00000028c0)={0x0, 0xfb, 0x7f, 0x6, 0x7f, "be1206d312d6b791cbcf4647323370ba", "dfcd452f2072bd97d758c1ec309716741b5c7632e48f6a77c353a1f460f1c0fef97b556d10cd1f6d754ee26b4856aaaa1fbdc3ac57445256cfee82385361d3e392a6a28376bbb062e208431597515b91c72afb28368ba32a0b97b0aa92c05c5123e94a24686c29f9aa7b"}, 0x7f, 0x3) r1 = accept4(0xffffffffffffff9c, &(0x7f0000002940)=@xdp, &(0x7f00000029c0)=0x80, 0x80800) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000002a00)={0x0, 0x2}, &(0x7f0000002a40)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000002a80)=ANY=[@ANYRES32=r2, @ANYBLOB="9b00000098540644119561e0715bed7df971dbeb3437e67d7844134a5ffd86106612f19e5062ca6bc9bec8127085d34dd587125884de0dda998fd3dc2517be46fd4992f5479843679f2537da453b8cefb00a2b781e901d37cc0a7a619ee76676775cf9530ae3b0fc8a4074c5504294a1093acb66eab84ff9a2bf18d1ae079930f6aa2ba7c94d87d723f3bb839588b447d3aefd99da7aaf4dbe74ca143384ac"], &(0x7f0000002b40)=0xa3) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000002d00)={0x4, 0x8, 0x3, 0x2}, 0x10) r3 = userfaultfd(0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000002d40)='tls\x00', 0x4) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r1, &(0x7f0000002c80)=""/126, 0xffffffff) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) lstat(&(0x7f0000002700)='./file0\x00', &(0x7f0000002740)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000002dc0)) syz_mount_image$vfat(&(0x7f0000000040)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x411, 0x9, &(0x7f0000002600)=[{&(0x7f0000000140)="cec5396e78bd8ff9346a36f15197a64cc26b0e40da8f8366c925728516bc96034d4340909bd1", 0x26, 0x6}, {&(0x7f0000000240)="cbcedff6bafc61d720c2c3514f19287f5bcd7cee11a396b88b92c138ea46852edacaa4d6664863465070a1027d4442ee6f0f6b90f1cfe0b92af178025a62e4467b3fcbb4b54646bdc4e26f072494255f7f7c3c696e099ae198a3b3fbabc685a5cb37201361e0d8b3f05a169d2c4b6379d256c8732a02679a7c95a26265c717c94c638e5cd82c8ddb915a2c825c7a02f86754761d3fe815416fea36c41d843c379e0483b5dc94e6f9024d856ad22af530e8c95f8b3bf79bdb1290ad9d7c6ecdfa11488000cd254001860c3fa6c27ea5f3bc078cbf943325dd9efee3a1e038c1c1e904744467240c51bb22353af4d676ca131de1349f03fcfc55084357ca10e28fd384ec2dd4d47ae7d233e17f6ad415d0c0e489db3dbc76653ff354ae56e4ee76957d2679fc56a9756f42c4e090f642fdcaf1fc46b8398f8d01998974fcc65c8914dd9aa39680fd588ee64d0386f7b62a5c5a6949a34f79253c5d1a537a9c85e3c8e08535bbf445c4d9e79db238392203535eb930707082ac607f0ad48da1f6bfcf9fadee73cd484536ab0b358d7907c8461e13a9a442d44fb69298a2056d8fad947cbe7e90576a7665903960eaa20451ed34bc3af063eaa6ad1ee6552af70344f5bfc4ef0bf094926408307d632d5962510f69dbea5aedc4a2a8d1950f019e2745297d15ebee1df9413c23b627b6efbfe557036f77971fafa398d388e63d1579811f73b4ab99705a484f98b561f359255f1eacd406c4cf05205496e7252455d53a345ad8829e756ebcbee8215773fd6850bc4bebb26acf670468762e168247daa317b36755f8141e116863afe781dd1820172bdee3261bceef08aecb3a260b82f93b51234604279ae800ae6a6da31be1b145ce97d852acd0569b1f87f8bd68fccef7342079d3b7d21c02818719d08f65cf3a309ebd54877336aeae669771bf820811d3c9efeb0099322599bd372acc0e2ad0e62d872b390319198be4266f47cf890d481e1bc916da01c3bc13a08e71d69bbd33eef1738b1028066a95457bf6a5c6e06c420778367f1fcf2b2d1011fa057bbb47bcfd01308ce37801413b64ed8dc4690ddf035d9022fd2903a6b3db6dfe42e1abaeac477583eaf5ed14242fee6b6ddf1e79f946c6561160fa5866cb1711ddc7f3ef0ca77c136c9f60c95a1935e66cc501b310bebb8a893aa36b058d4d5bf7854b536b52f5692655c02dbfc911b09d0c44ffb25d0eee02d18719a050f6cc6682168edfbc6a678d3cae054e5b19b15ed7becbed82c71c131b7bb07e3bbb33eeca3eed5a0861b96ca6767e4e7559a44369ddc61fbbac155984b2355d4e9c1bdd725b771969103cf64c791459bd0e95efb005a122cdf013eab6cbc41e48739b2e433eb88e9d75775a0b9849b4974e407649aca6bc3ab9c1bc333bf70f4d443cc4d9891085dcc8ec11b772319ba0bf8f823a39d7146877951c1dd9ebe33fb5dac280a3fe42ed043d41e47e2e9db72063be07d0b79e40dad98b1b7351417d913f7ad7bb08d4e70b69fee3f50a5a04f25c3b5adcdfde29a1bd509056877f4ad91a3e7034784a2f6e5f225dc289a91a06ce7b6a39f7ecdcac3db9be0b212119ef70ce49e14ac481632f4298b9ad3df5263100c15b982c542b2625765e06794bc36a6daac37036bde9cc85894a9132c6155f4aa23293e66e277222cf555eff2b8e7abb6f48c1ec3b8a9c1e084fed5c68d095562e95a17b4003f83da5b6e6b7759ebfdabe47def3cf9d46ae0a3ec482874541936263b88c46709179dc93b11a44fd1d7ba6e76afa43adf0706b9ad369cfd04d4e97a379fc8576fa12aa74a95b68aee95f6967c1024d6b90afa801005b2b0f3fe80b9ebec759c80501fdf71fbc0e8dbc21f1f5c22b295102dff6b1b9cc37225720e71ac2810b662a382a11051b550a6d188217dae10eb6843651d192eb6cd89d834b4f37d6db526b8825037665161849af2619e63e615f9633a6d22f500f845c4fedc3da918bd7758f3cf12078550703f8f4b16740a86897c6853fb81fae32302f6e5dd32ff147730628f54f1e80210de595f59de5dbd74dc8e2fd152811dc2b87ff6ffb1ffb298d6ea521f03d533537186dbc755ee6a89035ebab0542d126fd9798893561bbebb06229babdff3dba340bd150bdc1ee00dd38f05ae12774e84087596c0726a759077423a1f72206eaadbfaa0ebce20cc16d478bbece676afd9e9a650a898ef26156477b6c1f48cec73d8226c32d5c3cd122109947acb60a4e0405cd97b1fce4eb0e361bedc0071173e631aaf89f9f49f878e2aa5bada6dbe48ca7525a2b4258a4d2a10f3cb5d2a1479a1d27499225db1893500753a12d8679d65080deb726183aebb2a7f813ace24fff340af698c29df4d65984464c246ab2425ed5d38f91e166b9271d0dbf02f8c970a063e7a8039d516ad0c9b29e69254e9c771e8ce1799118910cd3041e2e1781ab75684a337c822a6b2528535ee6648435f97306e9ca8a0ccd0793f22451063b94a75a09bff24b87703aacbbed83159d04d63e64362ce86122ac8e4e5a0db5eea3b0cf1a5942b043770fc410fd5ff39b41db554c8afde505ff12fd727543052ad75ce143fe592c390f60863feea78e0f5aa0e6df5074cdce4affa34a61f1b327caabed3892f5aad55c7ad0ef578fd75ec27ed423f42415430a235654b71554c543f60f145d79aee9537ba30f98e1e2e02fa5bce610ecede01990472610b0ba429ac745420ae1781b1ae16360c44bcf3a6fe64fcd77a329c72d006a8a62a12fd8cac575afb49e47669d0af9aff92bda964dbcf09bbe835509da90d43f17b5816efec39105cb43d9284c38df02552eb274d1983943dcbe54f7b9a81748cbb3ed677d29abda47913221d353464c11d383376b03052e39b13abe8e9930fbda6da4228299cbdb4a1104362904aaa3776be9e175a31fca39546b3db21d30b44d51952ab3af98caab71a5763aeabe03b5476a03c170e517a4b944dd9c391b433f2c61c21b2cf0a4a03f74aa063b598572d5d9f4af2318f45e394fb1497f1cc7115e7a851d6c8d910600e6828b96e224bb2112f35fa90098a250da0431cfe7c35866a820635569e9424dbd10f1b3d8f4dd1affbf47685ff73fefcd865235cf2468d6bfb66b1adeee6dc09ba1a9d75c17303e85bc7f1c1fa1f10d421908ad47ae829a7375b3740583c0999ce85ae1e4766c9e2e58be7ea2482ce47ec4daf330f3af377db1a8dc8ed10579b32b513eef636c366530c552fd3a6b29f8ec49f060054f0a9df3d7ceebae31d602a48f574bcf65ffbc409aa126ad55db2a9542fc08c8d28eec9556deee5247bb7fd663da708f9ab2d5ca2427b58194357d737dcedce354bb82ffab1c7aa40af041b51748f408c655ca6599599127d089a09657948ab39227c47da47e3d71360e7dc6c10d8f192704f9bc6172b8188eeb05e59589095868c14bea4f41ecfff1cf89ea65b80fd66ae77602c04935ba5d101b080f95fe39e59142c96a35a0f2ede9c42a01232427b33f348135403dd2138204a5c4002c132d8504c9b28e317c1ba0f79695abbcdf8f647ba21b705a166fae7ab679a208f42627e1c91f04c1ac2aa4ff98a53e54f53e7f72ed98f7a906742e41e02cbbc951059c0e30f63b01b2d9b38f95f642a059312aa0eaafc86aaa3287e0dc3563976384e76dbb042ba6f1f02f0477cd21ff5df78502be2d8f22cb119cb3387e7b223c43881953f4cf01fd13c75650c6c41aeeb7d8f2ed03b04ab35644aecf4f4844ce756a784cff6435db39d4bfc99b0138011f7c083a21c34876c6a14c30e4f2c2dd6abc2fad6bfa3d6489346240d0538cbe9fd3c40d5b345891b936ac262380fb4e03cbaa922eb1edd5f9d1ba2243681a700ebf86f1ec8229fe2b3c9b0da91dea36852ec552eec2d143d2fa058f3ca625e73540786372b327d3ccf5a528667d6f15463785def784599d642dbe6b695196e60f25e629317ffb009bf82b52ce7562bccbfd35de0776e617c710d0ebb888d3fa908a588e4d15dcf3bf1ccd98423ef022f4a49f545eb54b2b43ce703abe19da0301b33f2b39a674d2d56ff3df6afe15ae957537aa9abc602745c4c705776dde8f72a8b9dfa6f10a6d260bb39f4127ca6af854cccabcee5f7c8a59e93d279a17aacd32ab13ee25128bb7636902c6a3ca0a8f0c115f180f1690324578b00a54825d90408753d4217bd19907a7e00ead37e17a21d26f29d5d96381faecc46f1888c2a3cd3143ecbfd9bd5f996811b6ce1cad98d23c2a7029f45f0da9035d1b3936123a7eea27c5a7da602fd8e09b1845fe8da9802ac7a55fb219a356e00ae07553d9fdbc3a45272d3fb7ad7f36cd00678b7b7752ee515ed171e9e960222c75f39c16fc007f6a1e4548f99acbb695ebe49c007f94540a1d7e92f894b6b36244ff1d80877046bbc4b9ccbbd9be85e9dcc70e002be37c5f2ffa529f77d508991dbef3532d0762cfa244c2d55687a5f4c040bfe32b81d9af1ba8a4e320b6a0aae1e181fb94993e7b93279891036b361fa1befe9c913bedaf3e951703babbdb3724c501c18f91ca3fef3adb282ce67ef72c2d91c5e5a9947b23d61e8e98ef586ea5299ceeb96c0fd52074892fa830ca3b0cb3e6fe2d1c1a30a8219b12921e630312efcf3c2aa10d5deeb8a0ba015ad9e74fde17a1cf692c5621020b64949219b0eea5049d606e8e86fcfef16b504f7d038adcc357a5a74f68f71502388967a27a361bd89a3afe43dad487d09d25856ecb4960292144c1536d2df0881bf49f5bf23b11cbd140f8f8c7bd44525fee39df19dfb31564b70c4e3e3f1e5730e99729ee3b73ad1e26120caedf2bfbee97a227d60e7f7bbf5163e56a45885b89e527725d7c943b506e830f26c4f79b63ffed4ee3e8d20376a034ed9d31df52dc6073a5f4397cc2004fd1672755b368ec72ae9a453539749636c63c64fb4f6220ecf4ebf5640bbc046e9f893a6d2d44459a4b8f99956f9395428537ccc480f01388926ef1d6235db430d82f0956baad5276fb2029a7dcf95e483b00256d0549d300790ae43cd13ba7e256bd01789cd4a46b3c73275e26867ebf33ddb85bd66173663d13ec1c139e6724d6eb3b28d0d261d2f279594853c8706d7729b304c8e7dd4728e28905807264a02fe818140851b8f4d43a74383a9f75526bc09d26705ef5b6ce43c08e338d1221f252766b7fd604b01f652a56c6ef257014636a805015e44eb9ce9ccaab9677bfd0ce04b08e82f5559bbc5e411895bbe4c38e2ca457f0301ab25093e205528be6e7efb256fd9a2b9ae55d82bc487cede3cc319721a853dfc27a47b804298ca19d9996dfa8be25b9a791e8ac3624efe885474ea4e2121065fb3af5717a176b272e8101caf35c11f47ebfb10fafd4c0efef1d886e9e6dbd670d513344efa89e89f0127bef60482d75ba7e703711cd97215176d2e0d8972b6c94c3aa1851fa143febce08fe2ce40609a33178209f0211cb843f06935dc3e2648035f58b48178ff3117ad5176ca583e837211032671d2242cecd86091b1f6ce54a0d85291a3cd800e3e0f1bd9b18dbae4533d2ce9c528a32ba705b498b6eb75f6c52999b452e602a24b4ef37f150ee3a6abc8517fdf3ccda39123dfbf439aa7695b18ef86f0dead6b3dd8a4b71f6b7de69facb2f47f76a0a9735252fd0ae2e83c3c4d498f66a66a200ef7b10c21c96ea82ea5156377fe9dd048304db6704480be11aef654171755d6c956d139c7e7510534a1ede437e8d0b5b1c1e32aa4539726724b3eb8b72d40fc15644de21", 0x1000, 0x1ff}, {&(0x7f0000001240)="3fd4502d77773fc3691a6aa674d542ced105c0dab1400e1ddcc5b8235c4087e49056c4229acc7e1df88f9c11224f43fdb742a4b3485c4e0a165960a15f9d684276d82e129f431db678836142054c04a2c404998bceffa6efc4d722bd35e34fa0ba9733", 0x63, 0x7}, {&(0x7f00000012c0)="eb591feee13abaae08a5ab831a5ed08951e5abe1ee0e9fcda24d67f400d82d35634d468b976f586d0a212b520345f19e4ad026c6320e823c41747bb1bbcfec6dacad", 0x42, 0x1}, {&(0x7f0000001340)="e9ab91aea6b3dea328ef2b5ee590d7b76359fb61d701e5a450861b02cef7a8aed287b46aeafa9ea79d78307dd62d5a21fac2126a8cae90c2a3dd00e4960973f24bce75304471d458c5a76f33085fb8dcf2ed668774e61caa5e609b930a04dd6de60c1f35657d11ac5252abfa31b7574c0e7f93521e82d800ae94d757f20cbed7c5ed8e299011764e4d21d22303eda6602c21e7c90b7224aa94e54e4506cc67eaaa01008b4a2b3302d27917199bc4167b6c6ca796d15c589bccd687de64e0a5663cbfc5329a072e736479bff1f2063eee0f390847fdc351bf4771f3f97e01b0477765d49983c165567480ada8b9b2263a912b4672702b3caccffa4002", 0xfc, 0x9}, {&(0x7f0000001440)="c9977e31a17f7b56acec07c4fb5733370066061f303dc3", 0x17, 0x3}, {&(0x7f0000001480)="9b4b4c4f126ca12a68830fcfa830bbecce7ced14618f503596e83d68ade037ab453409216a178a8ed324f74ea1a1a8187a9f235ec834982d5d9dda99ab5fa75702b0831e5f6906fbb4981b7ce8096072c274247e705e2b9bb7941d6f8f23ecba211b12c82fd6221e8cd855e4fe68dbf6f897d36303799a0238ad45f813aefda50b43ef243b88cc41fd63b184da1c94612141c3f56595d976a8bce6eba084f12dac7ac4729714", 0xa6, 0x8}, {&(0x7f0000001540)="a4c801093ee22b29a33f96b3bcbda835aaf1376c87135d5624f21ee4d935705630c3e7ba828a120623a85cc084506dbe4bb10990d23636484dfae1b34ae1bca34226b581c51454da698ac06d5c91679b106aa6db4e95d1ef5805db1fb243f98cb201f39b9c24798476b9e7b500f3673cb352e73ed2c1dfb2ab6076fbc9f7c0a4ee55b25d0103f68f17c544e835f902d99d8a54a92846d63c6c5d8858bc836a7062c301536488850304b98d17b766132597dce7262c5f1e1c17fca4cb356b4ac9b01dafcd8ca8c059f179001e706f5f58f0b3a96b28dc45375b3f41726cb5a4b0f0a0eb0b92b8d540e6e62ddd906eb6614803a18157a6400611e82c22a2ed9d42ed9270c1ff99474a97c310cf6350782d926ab68f33cff4a177f16069d7c0aa4f95d7131f3693868101b8d76d2adf01d741dbc4e746cdb64508f52274da2014833ab71eb126a3928ee41ad06892aec162097ee67bb45f1c834ece03805e4f97a58a1fa3af224c5922afa077ce183145aad42966c8341fe5dfdbea39955ebaa68d77447e2eb043ed1b5e7b5ab7fed40625c12287c9269882273096409b952200c6d5f5be8baa8e4cf66da921bdb27c931efc095f4c9fb39bf1a42e221127860f43e083ab641440c0ae6d4c928d099d182b015b63e3d7ad12d8e3804d2516bf100001082d498f87a57ad0889cdf4c0560045848a39b8fb0173f47e19bc6f80d57c0c2bac616a6d5169f32ac9fc03f127cc02ea8b48cd3c7c81d6db64fe925484ee00889624e6396d26e3c7a2a0daed0d4594c3ae2560e5ace0f4e42b63b1eafba1e6ca3fc06ab3b324c1e7f9ede5ac5c1997467649875993ba70adc262ed40069662a0b88245ddf89bfc2e581c03d06844297c18c2bc380a27e14ce8450048888766dbbe4e8524726088737abbee5cb79f13f81d55064e68b3b16402fa599ba77494c76a34cde7b72ebb2f1039c2cfcbe10307cd00d217b7ea5fb48c8d401ab08461fefa4fb70193811ab8ce422058ec3c395c8c17d26f3f36c0ee4485b84c9410680b3b864e6cd3c2a9e2869831e1898ad8b55b2568f65c411d758e05962b676c2c8599c082415b31cf9d5f9532c0b32ee9caae1f275c4f22e9bd678d52b8adb2cdedd7640349420ba966dd5c05885a03f94b1f48b2aa9cd2dad7eec96c35381c5fa3746750ee49bb4f67c1f47aad51103220e2554acec4244344aa240cbf807ae2ce4296332bce4d26a1bac8a7e4d2dfcd1e19bbbf4528101b1234e5981e8561919aae1c2bf4902a336ec3baf300660c95132a32ab5098d2ffea9ac85defa4eb3a95d32fbf4f7756f55e6a9c1535b1d81c732f157acfafec0bab67162ecc3a24830d42bf3597b9d2d457217e1054655dd7085b7d91b56f914fce52142ddab1c3b0814f672c0130f52e7699b46308bee0329077ddffd68f46dc0dec3ffa51fdf6da349e15ce4dc5b31baf81593d5f6d472cb27a53bbbbf06584b1be620d93c4f1371470ef63335725f7b2d63817344b5dd8841c04dee476d043be493eb7f6985a247c2fb8313cf239eb64a5e389c2358d90d9ed3d5252623e296924218540195d3bee824cb2ac38b74f0d40be15248b83657e070fc2bfad95289ba04d2d3cd2e3685342ffe51c6c1bd7bdb31fd295641a253fc00ef1d8d5851e6ed28595eeb25cc6c4e384e66e855acaf9c87064a9f94c31b0df5a8952f9e7f4c7c147ec1bcc1488c4f574f3635b9c1a53b77ae697006390abc00ef73fcf9b2fbcac31c6a8dbdc399546d0a20415f804ba7a3070e569d5bbcdd645b584c4f2593160e3501a7d43b7acc545b5a6f54a75ec37beffb632f10ea735603d86381577a83cc163fde3cf36270231655f4d1b2e52f3eebaf9dffe5db32c534e927a28144c388e84ab44b369041a5a71a2b710b2ca467b104181710f8fa188ae9d8e1fbf797a3c0ee13e62033a9a6f7ebd9421cb790e56f2386ef327da0db9a8f1df2264b68aa376c2e749614cd21a5914cb570bf5e7b5d57740cc2e879c05aa81ff46f3c6772f551aa1b3bd99a720ed3b8424ecd0535d22f6fee47da92a2e43aa82c8af751dd53fe524ec0a7447127657a02099af80693cbefb89229270a4ca2b7376be5f495f896bf8920e3eb7fbf3876a0309e3779f422ca570ef53c7f2313ad715e2af82d82025c0a46b9efd95853cdbba40c3cd861901e289c6e6c24005559300f5dcf2667b39dac60e51566b07f7590c7ca9164d25d95bbad7919493f6d4e08cd9707721b97ccd808f9d2a58648f97989eadf0ab97438b8743e0e21a2100f9831e9f0a30cd0e486ba5ada57fc6645099bf30d2a79b7c386b248d9e561b6f2328d389eb1bfab739960798c960fd0027d6d54aee91d7b220bfdd8d51a0fecfe50f055524afbc7dd165484e3fdd32acbbdaab99aa00e19a98329d9ad709735f79bd9e00f1d89d3c442ad30ff5dcca8c61d1d5f0233309bb788a6a118419d223fcc8bc39fcada60f9253dc658265c126375b24617f2be4fd861dd1de3db9c4d91c7861ec691d8df4797c45d2d8be50c695a20fbb2fe772297202554af986e87f24d072121bb991e5267b5ecc5bb5b360f1ad64ad57e8fd7b9d7b71de505daac78278c928eadce601a585401e7246a80cccf54753b0e8072342895e55d2efdd2971f0da0f9150b604874324192697b1265b6f7f565df9f7000f4702db1dd2f5fe89c831ec0246957f4b7e8226cef3a5687a417bd768a605cab5875933fc180367283c131dc9734d2c6589c3f7d7c343b5d0a7d94bc044e13deee0e4e9d6de6ab0bc6b5425d5b8f21ffcab7d380a45b717713536ac67e4110c2f6c04d0b99edea9aec688609399f5f104e9c73c3bdd2e9d7b08be93efc224e6dbc0db786b3ce7b07d2b21ab90c44686a133b778ff2af5490df948c5398c047ce8f72560012c68e39f45171d806fdc97157c86ac5d7fee889fbe70028b48689d7e590ddf7115e136e7affcbe0ce154f61d9baa29ca53d504ca8c6c40c82d098b7294d91800b3818f12afa4ca2bd11dd7c7ae185beb581cb8e3c2b4a785ba52a89e5e29e6593bfd5437414c61bcc933d1d61d98694615ca5f0af6715839381fe13a130026cab5c895e553c1e2f92212d34b3524838c50979b0fb6ea13b950b6d8a3a97aa60208d44d38ff46d38c8d5329a9848e8a599d42bb5a7bac26cd61352a8b21390b8e15b4da3044cf11b852ab5aa23704de31a69ef670840177027b5c16b0e26718ed3aad13ac705de333ac4ff64c141f0b45add9a39b28c4cbbc725eeec94ede8e72727a6f069c0a4a9dd6b858a7bbf71b3ccba8cac565453a409a1b45117f9e0ab62f93db415be86cb021580af14ace9035324c28920c117be9e1dedb03ff69e7e39f2cf18d2c78c55e46118307b877a1c6617a1721125ac4a1ae0a8fda2cf901d2d3d7318955d4c051279f8913fd1a75ac1cacff01abfe945aba44c14d47ebf8b6f0dd5cd7d42f5c351f39c5768a31726d62c2958b2cb772db0045555ca99b0763697a198bd9c68b647f654e1bc7b2a14dc33f2faca84594dd839d5270bc6fac6d5f9bcc838c57be6d62e070a90d57f7ff337e3f1bac2c27b7ce1d60e1fb7af0e6350db7328391dafa4f97b1a074da4eec30e07dbb85cc1e3824da2ed730fde5e9a06e861eef4e9a84ae924b8a3676d8d43989fba43d48623ebed2e7b4bc8ca0ba0b7557914dc5d8d4368b202ee8bbc9e7e4cd1ed40fefd83ed50823dbdcc339cd2cf2b943b3b7b2302078801ecb786902d8e82aead5e1a25152c30a8a3d1878de2f45196c383feb347e35100c50c94671c16c76fff9685018c9c50dd221cc8b9b8d4384af0e59fb75afa0526cf771b64c9bf5a7e93414e7793eaaac6a4f923235eef1e5453fe6e343e8d81cf364f5865f80125ddc40715c35c728039c35be1bdd4b176660f91a025e015563701915a5c237aea6c2f4e490e68d542a93a93412bdc7d96382dd8f1549da916896068ef7518dd01d7e1c975b3ba1184b6b2b2adc47b07e296cf26958ab8b5e83b365cb57832c6bb8f1cb161c0bb9d92d7cb33204fe8903ba40635ef0c4da09851ec99ace5748f1e5dba2c4d854205d4c029601a8f494f8699f31f313747ecb4437eae808d796c09dd2188f64348f0f31cefd59fadb8d37eec6f5108f7909ab7ab67148554486fa0a7ea17270754fc3568faa6b8f76159cbdc2d866187170d4b65890c1f1cde7a5e590c07a33dd548ab451d6df5545698d82c451f9733d9ac1a254d1f15893a00613079ff498814e78b239ec76d86a36c1abb3b100d273d5404bf0a6bb5a388a4a19026f8d64bc92d2a2bb5c01dc96af84768ae24119a01052caa4c52ba185706d64804a406a159f2fee02310de260cb975be734a7fbcaa0ef24131dcc789f76e02ac1b28736dc38edcf30131228a72ee8ef455979737efc3a722ac4bb31487cb81f666c9b16bed23afb8089ca70f3650034697d8dbf17fbd20db0dcd4edd9d512b3ef6b402b485e9da28535d0c1b9462cdf8d20a30402c6da997845d62e245578ec2c0f674f4e5bf1602743220250b9de8b58448a46b7006ff24f4b645364432470cda2b0a4ed79a4a0831bda9f1eb0a0f9995872aa6445d4998fca3fd22e2d947858b5f44ac5f0954bdf7d4acf87e8b9624b378b2916c66e85030332f899c6adb1a51c01299c48d3126dbd3256d77c1ee9176c5b03145cf53f9a2d025e689c476daaafd9ca584accbd1a370751907765a294773d9442fdac235307b76d728329739c6880ddb2f2a48b59c139a9c3b6ed5113ebb4e54831ac5de855c8d45055c5bbd429ea6000d316ce2b6ee7690911d04afcf571d4e1404ad0f20f811c0ed3727e50f0c8c96020373d28eba92cae47fe8fa648b3fbb696e24118408d63ee24ff1e9a933cbebdebe4474cba4ac4b7281fb94f7b002c2947d11029b211895b529fba2e2d1cde67044c728840e468e86cacc3b2b0c63513b8cdec9b6b24a225ef4e830218bca7296387a386d9b50b6f660c6b7d79357d54716b4bcd27c28f4671f33803bda80078da2cfe2f7e82b90e3684609a1b34829a70ff3bb33faef03e7d51afa981a038579f114716698247c7e62f1bbfa413075519fd218f0b8fab01969a6d42991fbee2cbafd61fc9d01194342edd34ad3b04a3033e9522151b62240dcfefb0a15061782ae467a9ea226f83d4cc509e25338a8053adbb8357007cd9767660854d5f9774013e5d020fe1e1d7a62f59b2f8fc936a5f544a5af56448a38e72c0323d8f9034946612642a693482d70444681416bbaae86e1f1bf7fb93416f478615da91bf0e644361a9e43314ee5b86f927abec34ca49120d4f5d3ebe4e0b109c2f02ec0e93b16b43127c3cede842becba3b51ccf7df3fd0fe95d07d960d852387ad4c873d945d1929eef3a233924fd5b8c8e046f10e8cc7c3983d1f6fc32b742135ab011fc3f1182578dcecda0df76faf81c2c048e3c389111464ba0755c5e77c1b3fed8f7ea65dc9ed9db1783cb08e5a4cdb226854140b2d952c279e841e5d3f935d6d74d8625ac52646be2ee42e6e74c0bb464ce7d6a8e84bc388afbcb4276f067ef9bd54d00b7e29ab8a0e43f190ae7c2d1a28510348154c96d54650119cbc243c6bf861edaae1b949f37ff80df86bbe712d7d1e0e24e782d0ec98a5882e86e5284178ec1b6898e035104a521aa347b87bf730f493535612b0031e850c9e7f9f0654c6501863af8f889dd064c8ac6e4e2fe92a586027383afd02b02e761595ed063daab624b49ca3421bf017091a1a37b00e1cbba660b54a06", 0x1000, 0x9}, {&(0x7f0000002540)="96c7b635d5b54cd1dfcca63a9066a02d98fc3daca1bbcfd7c3fe4acef527903b4c3557815dfcf6ac651ab1681c7dbf10731535a633623046169218977031ca35cce3b00b23f60216c0bc0b06ca28fef2db871584cb1d8dc01549a604ff29068ec440c03dfc470e81703f0712ad7022b137f34a5d26e9fc37235ba377eac5ba3f781c46e24f6445b34db0", 0x8a, 0x6}], 0x8a0080, &(0x7f00000027c0)={[{@nonumtail='nnonumtail=1'}, {@iocharset={'iocharset', 0x3d, 'macroman'}}, {@utf8='utf8=1'}, {@utf8no='utf8=0'}], [{@permit_directio='permit_directio'}, {@euid_gt={'euid>', r4}}, {@measure='measure'}, {@seclabel='seclabel'}]}) truncate(&(0x7f0000000000)='./file0\x00', 0x4582) pselect6(0x40, &(0x7f00000000c0)={0xff, 0x0, 0x7, 0x0, 0x2, 0x5, 0x100, 0x5}, &(0x7f0000000100)={0x5, 0x100, 0xd94, 0x2, 0x0, 0x7, 0x7, 0x400}, &(0x7f0000002b80)={0x40000000000000, 0x3, 0x0, 0xffffffffffffff80, 0x2, 0xfffffffffffff370, 0x2, 0x401}, &(0x7f0000002bc0)={0x77359400}, &(0x7f0000002c40)={&(0x7f0000002c00)={0xffffffff00000000}, 0x8}) dup3(r0, r3, 0x0) 03:37:08 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:08 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = open(&(0x7f00000003c0)='./file0\x00', 0x40000, 0x100) ioctl$sock_ax25_SIOCADDRT(r1, 0x890b, &(0x7f0000000400)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x0, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) getsockopt$inet_mreq(r1, 0x0, 0x0, &(0x7f0000000480)={@local, @loopback}, &(0x7f00000004c0)=0x8) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) clone(0x200000, &(0x7f0000000140)="6519df64afdb1b80cc77573bd8bd2fdd31f85818845081a70df380c4c7a8be6b1f58668bf2f00ab3f335c7dbb5ed0fcb797c0c493aec2050fa8b457f487bdf96e29675ad7a44e454eafe7ce53aad6c68448f9140f747b7e07db4e04aeac81f4521faef62d50ba42aa2e844ca94532084f7d31bba03c017fdaa294e2969525a0d3700c4ff19d6f55c270740d0ba12df75bcb65dec62c4e466d54a31005c7230e1f302d784d98facef9de98741e04aab52497dd56e174b84b7e8122bce1ae2b35896ce73170ab59f47bd0e6b5b7b98bbd691601f58", &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)="b0b9c6a7c4cde5328d81faec8636626e21810051bde623b5cdfa8bc2bf43fe7a008c28d2540939c9db18b679bbe901bc3eb4e23f80e78106ccd765b66ad5526a6099fce6d43f4014d4bbecfc08f7d0c714f64dad51c8f5fd4ca08224da59f00a423ccb4054802a95bda28535a07367d8ffb94e810341780453da59377794ebb4887de925fb0bc3a0ce1f4c695ed69725308fd8982ab84a520cac34eb1a94f35196e88bc1b5154d83641851b2e008229ac740807bf1fdf924fa726ea207b7bcb6f85405bcbe33dddfebc5211b5700f26c5b09b0246fdd1e6c98c6798ff94657") ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000500)) 03:37:08 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x4000, 0x0) 03:37:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000000100)=0x8) r2 = creat(&(0x7f00000001c0)='./file0\x00', 0x6) write$UHID_CREATE(r2, &(0x7f0000000280)={0x0, 'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000200)=""/96, 0x60, 0x80000001, 0xecef, 0x0, 0x46, 0x20}, 0x120) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={r1}, 0x8) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='_'}) syz_execute_func(&(0x7f0000000080)="c4e126528131a900006726410f55e4c4c3755e731652c463457b2b7a0c0a41dd71a8c443f9685892f3c462259cb8b0000000400fe2a98d000000c4e17c5a20") 03:37:08 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0xc0000000, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) openat$cgroup_ro(r0, &(0x7f0000000140)='cpuacct.usage_user\x00', 0x0, 0x0) inotify_init() getsockopt$inet6_dccp_int(r0, 0x21, 0xb, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x1b) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) r2 = gettid() ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000180)=0x0) kcmp(r2, r3, 0x7, r1, r1) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 03:37:08 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x40001, 0x0) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f00000004c0)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x5c, r1, 0x320, 0x70bd2a, 0x25dfdbfb, {}, [@SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x4}, @SEG6_ATTR_ALGID={0x8, 0x6, 0xffffffff}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xba}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x2}, @SEG6_ATTR_DST={0x14, 0x1, @empty}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800) r2 = add_key(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)="3190f495e40110ce7c8c120aa36cb896cbfdb0f9548b495d5889b62adf0fc744741feb6a3b9537fde58f5654fde3f676ba8340f785308022ecc1c84b858b96c8e78c850cdcc1a883176c70113006a9a1484bbbdd464726c3833407784a89a05b35c4b10a2a87cb9b30141463bdf1bd9b932f1ac702485cb0593a2d766408ef93bb12301db1c91712b30ee0f75c24fa763aeb0195ad92fdb232c47f32f188f591a502cf66bab914cbfb16613132bf8604afed8813bf7678e9e6b1ca9a622bf1a2adc320d73a10f0717cc758367804f71b56c5be1c5547a9791eebb822c2575b3a", 0xe0, 0xfffffffffffffff9) r3 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, r2) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0x1f) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r5 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x1, 0x8000) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x2}, 0x0, 0x0, r3) ioctl$VIDIOC_SUBDEV_G_FMT(r5, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x0, 0x8000, 0x40000301f, 0x3, 0xe, 0xb, 0x3, 0x3}}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:08 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5054, 0x0) [ 595.363374][T18477] binder: 18456:18477 got transaction to invalid handle [ 595.391465][T18477] binder: 18456:18477 transaction failed 29201/-22, size 0-0 line 2994 03:37:09 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000140)=0x1008040, 0x4) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:09 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0xfffffffffffffe6c, 0x0, &(0x7f0000000180)='\x00'}) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$get_keyring_id(0x0, r1, 0x9) 03:37:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(0x0, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 596.021462][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 596.119138][T18715] binder: 18713:18715 got transaction to invalid handle [ 596.126384][T18715] binder: 18713:18715 transaction failed 29201/-22, size 0-0 line 2994 03:37:09 executing program 2: r0 = userfaultfd(0x300000000000000) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x18040, 0x0) getsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000040)={@loopback, @multicast2, @broadcast}, &(0x7f0000000140)=0x4) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r2, 0x0) 03:37:09 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5154, 0x0) 03:37:09 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000180)={{0x6, 0x5, 0x0, 0x4, 'syz0\x00'}, 0x6, 0x202, 0x3ff, r0, 0x2, 0x4, 'syz1\x00', &(0x7f0000000140)=['/dev/rtc0\x00', 'reno\x00'], 0xf, [], [0x77f6, 0x8001, 0x8, 0xe07]}) 03:37:09 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xb931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:09 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:09 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x100000000000, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:09 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5254, 0x0) 03:37:09 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000140)={0x1000, 0x100000}) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xd, &(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) r3 = gettid() openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x800, 0x0) r4 = dup(r1) kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r0, &(0x7f0000000100)={r4, r0, 0x9}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:10 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xba31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:10 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000180)={0x0, 0x6, 0x0, 0x7, 0x1}) ptrace$cont(0x1f, r0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r2, 0x40286608, &(0x7f0000000140)={0x4, 0x0, 0x0, 0xcd, 0x1, 0x6}) 03:37:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) msgctl$IPC_STAT(0x0, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(0x0, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 596.855485][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 596.960080][T18971] binder: 18969:18971 got transaction to invalid handle [ 596.967275][T18971] binder: 18969:18971 transaction failed 29201/-22, size 0-0 line 2994 03:37:10 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x8080, 0x0) read(r0, &(0x7f00000000c0)=""/126, 0x7e) ioctl$KVM_SIGNAL_MSI(r2, 0x4020aea5, &(0x7f0000000040)={0x6004, 0xf004, 0x400, 0x6ea0, 0x8}) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:10 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x541b, 0x0) 03:37:10 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000180)=0x7, 0x4) 03:37:10 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xbb31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:10 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000140)="2d7bb9569cf504309c3138ec0ceab026ae9c0843f1fddf736a496ef50ba562c1fc08ab2ae696ec1178e5e3ac94bbcdf882f3a3a9484c9323423cbd787ee6d8ca65e5b2f3f9fb164b6c14e3f2b23b080367102a391c038abeedc8478bbd951b3f6b5daf36253e1e318e080bc590e6b61927767e286016cb960e60781613e9e72b26c403ecf637694cb65edbc457382a3374de154665a4662c77c793d91a9dfc930a5494eea9a7f07a305eed0afce48df946522a410767492580b910a0c10000000000000000000000000091efb05dbc6118d77125052d093f1ea6e4faaf81e11d984936750b8f7a2df0d4c56b2dcabf1988056d9c61e5ad606a7448b250db1e421482d2464a49c5ce1352d4f88bdab39c81f7d5db572f3e7f31d903773ae65989fa8383dbc0269480") getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) setsockopt$inet6_dccp_int(r1, 0x21, 0x5, &(0x7f0000000280)=0x400, 0x4) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:10 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1d) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="d0f94100", @ANYRES16=r2, @ANYBLOB="00032bbd7000fbdbdf250a00000008000500e600000034000200080007003400000008000b0002000000080003000100000008000500461f0000080008000004000008000700af020000"], 0x50}}, 0x800) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000300)) r3 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x9, 0x2000) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r3, 0xc1105511, &(0x7f00000001c0)={{0x0, 0x0, 0xfffffffffffffffa, 0x80000000, 'syz0\x00'}, 0x3, 0x10000020, 0x0, r0, 0x4, 0x0, 'syz1\x00', &(0x7f0000000180)=['reno\x00', '/dev/rtc0\x00', '/dev/rtc0\x00', 'reno\x00'], 0x1e, [], [0x3, 0x6, 0x100, 0x40]}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:10 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5421, 0x0) 03:37:10 executing program 5: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:11 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xbc31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:11 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5450, 0x0) 03:37:11 executing program 5: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x100000000000) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 597.684098][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 597.858452][T19333] binder: 19279:19333 got transaction to invalid handle [ 597.866900][T19333] binder: 19279:19333 transaction failed 29201/-22, size 0-0 line 2994 03:37:11 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80002, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0xd5, 0x0, 0x2, 0x9}) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40106439, &(0x7f0000000080)={0x100000001, r2}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r3 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r3) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r3, 0x0) syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x82, 0x400040) 03:37:11 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5451, 0x0) 03:37:11 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xbd31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:11 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/sequencer2\x00', 0x2400, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000001700)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x5, @default, @rose={'rose', 0x0}, 0x6, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mISDNtimer\x00', 0x101840, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000400)) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800000000000800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000280)={{0x1, 0x2, 0x100000001, 0x3, 0x5}}) r2 = syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x606da6da, 0x2000) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000100)={0x0, 0x80000}) r4 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x280180, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000340)={0x0, @in6={{0xa, 0x200, 0xfff, @mcast2, 0x6}}, 0xfffffffffffffffa, 0x1000, 0x6, 0xfff, 0x2ee}, &(0x7f0000000180)=0x98) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000002c0)={r5, 0x6, 0x5}, 0x8) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000200)={r3, 0x80000, r2}) rseq(&(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x4, 0x401, 0x2cf, 0xfffffffffffff0c6}, 0x3}, 0x20, 0x0, 0x0) 03:37:11 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x81, 0x101080) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x30, 0x5, {"ae3fdd81a0599e6211737eac4b3f7482071fe5ec3bfb75"}}, {0x0, "4e1c218d52921285f469554e9d11915368fa08dbef53a26f0cc741e4ef6bc35901d1e30da5babafeb12afed311809da3558aeaf30fc9c8c47d8bd788b663c7bd0db7e6db1dab5ca8ee87"}}, &(0x7f0000000200)=""/89, 0x7c, 0x59, 0x1}, 0x20) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f00000000c0)='syz0\x00') fcntl$getownex(r2, 0x10, &(0x7f0000000300)={0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800) perf_event_open(&(0x7f0000000280)={0x7, 0x70, 0x4, 0x6, 0x6, 0x660, 0x0, 0x7fffffff, 0x24, 0x7, 0x9, 0x8, 0x8, 0xffffffffffffffe0, 0x5, 0xffffffffffff8001, 0x800, 0x8, 0x800, 0x5, 0xc47, 0x20, 0x3f, 0x100, 0x9, 0xffffffff00000001, 0x5, 0x2, 0x5f0, 0x9, 0x3, 0x4, 0x1, 0x5, 0x0, 0x400, 0x4, 0x4, 0x0, 0x7, 0x3, @perf_config_ext={0x72e5, 0x6}, 0x800, 0x30563075, 0x800, 0x6, 0x8, 0x4, 0x10000}, r3, 0xb, r1, 0x8) [ 598.536053][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:13 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000140)={[{0xfffffffffffffff9, 0x7f, 0x4, 0xff, 0x838, 0x2, 0x9, 0x7, 0x9, 0x2, 0x7, 0x100000001, 0x1}, {0xffffffffffffffc0, 0x1000, 0x8, 0x19, 0x5, 0x9, 0x3, 0x5, 0x11, 0x1f, 0x4eef, 0xff, 0x1}, {0x3, 0x9c, 0x2, 0x1, 0x80, 0x5c2d, 0x81, 0x4, 0x1, 0x401, 0x10000, 0x80000001, 0x1000}], 0xb0}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:13 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5452, 0x0) 03:37:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_elf32(r0, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0xfffffffffffffce4, 0x3b0, 0x5, 0x2, 0x8, 0x2, 0x0, 0x4e, 0x219, 0x38, 0x70, 0x7fff, 0x4, 0x20, 0x1, 0x9, 0x3ff, 0x86e8}, [{0x4, 0x80000001, 0x0, 0x2, 0x4, 0x7, 0xc7, 0x7fffffff}, {0x6474e557, 0x1f, 0x0, 0x75, 0x4, 0x1ff, 0xa03, 0x1}], "e2cded4e1a278ac94468dc17fc6158abd698034a000e0a24a7578a007aeef7937d1c44ef4bf21eba8658fed5cc5132799d95125958a509b47135ffea5d504b8bff831108a0cf496352b7d35c17eb489dd94a", [[], [], [], [], [], [], [], [], []]}, 0x9ca) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:13 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xbe31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:37:13 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/capi/capi20\x00', 0x400800, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r2, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)={0x230, r3, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x7c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffff8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffff873}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd0b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @local}}, {0x14, 0x2, @in={0x2, 0x4e22, @local}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xebb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5a714f68}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x3ff, @mcast2, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0xfff, @remote, 0x7}}}}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa25a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x54}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffffffffffff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x200}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x55d}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x40}]}]}, 0x230}, 0x1, 0x0, 0x0, 0x11}, 0x4) dup3(r0, r1, 0x0) 03:37:14 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5460, 0x0) 03:37:14 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) process_vm_writev(r0, &(0x7f00000015c0)=[{&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000001200)=""/251, 0xfb}, {&(0x7f0000001300)=""/238, 0xee}, {&(0x7f0000001400)=""/79, 0x4f}, {&(0x7f0000001480)=""/101, 0x65}, {&(0x7f0000001500)=""/159, 0x9f}], 0x6, &(0x7f00000017c0)=[{&(0x7f0000001640)=""/211, 0xd3}, {&(0x7f0000001740)=""/117, 0x75}], 0x2, 0x0) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f0000000140)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={'rose', 0x0}, 0x5, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x6, 0x1, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ioctl$VIDIOC_S_HW_FREQ_SEEK(r2, 0x40305652, &(0x7f00000001c0)={0xf11, 0x1, 0x5, 0x2, 0x20000000000040, 0x1, 0x1c6}) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 600.625339][T19582] binder: 19467:19582 got transaction to invalid handle [ 600.633297][T19582] binder: 19467:19582 transaction failed 29201/-22, size 0-0 line 2994 03:37:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ppoll(&(0x7f0000000080)=[{r1, 0xc208}, {r0, 0x9020}], 0x2, &(0x7f0000000100)={r2, r3+10000000}, &(0x7f0000000180)={0xfffffffffffff800}, 0x8) 03:37:14 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x6054, 0x0) 03:37:14 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xbf31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:14 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$VIDIOC_SUBDEV_G_EDID(r1, 0xc0285628, &(0x7f0000000180)={0x0, 0x7, 0x4, [], &(0x7f0000000140)=0xc6d}) ptrace$cont(0x1f, r0, 0x80, 0x44) 03:37:14 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x60ff, 0x0) 03:37:14 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) r2 = request_key(&(0x7f0000000140)='pkcs7_test\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)='\x00', 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_QUERY(0x18, r2, 0x0, &(0x7f0000000200)='^\x00', &(0x7f0000000240)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:14 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x7400, 0x0) 03:37:14 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) [ 601.265412][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:37:15 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) r2 = getpgrp(0xffffffffffffffff) r3 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x1000, 0xd3d1, 0x246c, 0x9e, 0x0, 0x2, 0x240, 0x1, 0xfffffffffffffffe, 0x8, 0x7fff, 0xff, 0x7, 0x2, 0x80000000, 0x53, 0x2, 0x1, 0x2, 0xfffffffffffffffd, 0x1, 0x101, 0x8, 0x1, 0x2, 0x8001, 0x522, 0x4, 0x9, 0x4131665, 0x7, 0x10001, 0x8, 0x693b, 0x8, 0xffffffff, 0x0, 0x80000001, 0x0, @perf_config_ext={0xff, 0xde54}, 0x400, 0x0, 0x2, 0x8, 0x0, 0x5, 0x8}, r2, 0x7, r3, 0x8) read(r0, &(0x7f0000000340)=""/126, 0xffffffffffffff96) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r4 = dup3(r0, r1, 0x0) ioctl$SG_GET_VERSION_NUM(r4, 0x2282, &(0x7f00000000c0)) 03:37:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x800, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r1, 0x40086408, &(0x7f0000000180)={0x1, 0x7}) wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socket$unix(0x1, 0x7, 0x0) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:15 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x9400, 0x0) [ 601.506734][T19642] binder: 19633:19642 got transaction to invalid handle [ 601.522862][T19642] binder: 19633:19642 transaction failed 29201/-22, size 0-0 line 2994 03:37:15 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x1, 0x688cedfe6e19ce28) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000100)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:15 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) tgkill(r0, r0, 0x41) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:15 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x307100, 0x0) 03:37:15 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x400000, 0x0) 03:37:15 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000140)={0xc8, 0x10000}) epoll_create1(0x80000) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:15 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:15 executing program 5: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 602.175737][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 602.293550][T20001] binder: 19999:20001 got transaction to invalid handle [ 602.301975][T20001] binder: 19999:20001 transaction failed 29201/-22, size 0-0 line 2994 03:37:16 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x50b000, 0x0) 03:37:16 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:16 executing program 2: r0 = userfaultfd(0x80000) r1 = dup2(r0, r0) ioctl$VIDIOC_G_INPUT(r1, 0x80045626, &(0x7f0000000000)) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ff9000/0x4000)=nil, 0x4000}, 0x200000000001}) r2 = userfaultfd(0x0) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000140)=0x21, 0x4) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r1, 0x800443d2, &(0x7f0000000200)={0x0, &(0x7f0000000140)}) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/video2\x00', 0x2, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) ioctl$TIOCCBRK(r2, 0x5428) ioctl$sock_ax25_SIOCDELRT(r1, 0x890c, &(0x7f0000000280)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, 0x8, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @null]}) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x200, 0x0) dup3(r0, r2, 0x0) 03:37:16 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:16 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x70a000, 0x0) 03:37:16 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:16 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x713000, 0x0) 03:37:16 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$get_keyring_id(0x0, r0, 0xffff) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0xebc4) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 603.019873][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:18 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x200002, 0x0) ioctl$TCSBRK(r0, 0x5409, 0x0) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) prctl$PR_SET_PTRACER(0x59616d61, r1) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) connect$netlink(r2, &(0x7f0000000180)=@unspec, 0xc) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) 03:37:18 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x740000, 0x0) 03:37:18 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) pipe2(&(0x7f0000000100), 0x10000804) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x101001, 0x0) 03:37:18 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:18 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000240)={0x93}) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2, 0x0) ioctl$IMGETDEVINFO(r3, 0x80044944, &(0x7f0000000040)) dup3(r0, r2, 0x0) 03:37:18 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x940000, 0x0) 03:37:18 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x6b, 0x0, &(0x7f0000000180)="575393760c175f353c83a00ac5097c7650f60048c42c3aaa281ac847d367ae8ec9cb65804f73a4ce981f3392fe20ed0d3f81768c1ddf491060cb52282593dac7a417f9f3a2cd239c226e70c8446becc81c98e8a2e83643d044ecae8e916bcb04dbd6d0bdce52fc123fa072"}) [ 605.104423][T20363] binder: 20248:20363 got transaction to invalid handle [ 605.115497][T20363] binder: 20248:20363 transaction failed 29201/-22, size 0-0 line 2994 03:37:18 executing program 0: clone(0x804003, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000e40)={0x0, 0x0}, &(0x7f0000000e80)=0xc) fstat(0xffffffffffffffff, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000e00)='./file0\x00', r1, r2) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) perf_event_open(&(0x7f0000000180)={0x4, 0x70, 0x2, 0x1, 0x1, 0x8, 0x0, 0x80, 0x80001, 0xa, 0xffffffffffffffff, 0x7, 0x3, 0x100000001, 0x100000000, 0x2, 0x7, 0x4, 0x1, 0x6, 0x9, 0x5, 0x2, 0x21, 0x4, 0x3, 0x9bed, 0x4e02b33a, 0x4, 0x0, 0x81, 0x80, 0xd733, 0x5, 0x5, 0xc5, 0x9, 0x80000001, 0x0, 0x80000001, 0x3, @perf_bp={&(0x7f0000000140), 0x1}, 0x20000, 0x4, 0x80000000, 0x8, 0x1f, 0x8, 0x9}, r0, 0x8, r3, 0x2) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x4, &(0x7f0000000340)="84f008ac8a7f9402fd493fa9fb2c238459366c219dbe54115d030000b63c89ff45f21d8c4291b0b7eb5fbf261d59ac82f6d960406137ef549040006d5133ac371b0af3b29423e1780a5fef6c7254dc98a1b8700852f140e084679fdfcd2d5acacc3501a395827cbad8df07fab31f569765cd04cdeaa34b0e26459c680739e80e3a6decab7831a3cff26c156a5d4602b8d1d104adf023ef8deda39153e14cf481f455cca21e7e433375c0f0ead9a4db6d47b1bffcae6c2480dcfc251f6ef83c18b68f490b2a91168a3d458fbc9b51b6c7c96219071a58c1c83437b6b99d8413aa70eaf95f11a04b854ca485ecab572c36472f5e706192ba2979e80a8727d589235c93ab688b9bf6ed652815d3c0d1ff963c3a4950c3bed17cffcb6a2e6a5bf872f55611b64ecba9c62df8fb83f8d090ef4fba900aeb492f7ede243bafe968b9ed77c76820d7e3c0d659c74901ead19ddede3cea7e11c1") ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'yam0\x00', 0x0}) sendmsg$xdp(r3, &(0x7f0000000300)={&(0x7f0000000280)={0x2c, 0x0, r4, 0x2b}, 0x10, &(0x7f00000002c0)=[{&(0x7f00000004c0)="f029c76e3bf08c613d6f2c30cdd81cca736e364705b8cdcc9166d4f54f3f0fc8d25d2262dc3968653f78a27cb2c7265cbf47f5050ae480469c52de6e688bfc0825d3556a54644078747997c315cfe63d68ab204c90b58622093c596b55112411ef494e4cded370915a5605a0d78c47421edaba5a1e0960e9b2c5af7c13067300fc4c42e87d61fc037b612063106b1cba494e8f664c3adb004167415b13c87aea38de159dee35bb7f0185319c5eb4126dc1590c5a7800867f44d94b7e671e3f76015b1b59a41948c0ffde2d5a25b40f9e90296265d3bee767", 0xd8}, {&(0x7f00000005c0)="eff9e5b420055795b7fdad81ac631eb2699059b11651aa85d2459c7fb9e809abf5a34bb3b67364128b0d9b20b22b23d0942d207ddd9f9df33c253d16b7892600ce00ce48bc69c761bd57fc10c12bc499b729de626911283430d8d0dbf678814f151a5520222a8206aaff5f209ac3d34d1df05f2e324e9fb8795497236d712f877ff50705b0994369275a609880d27eaf9c54fe7489f8396ff76b39e8571d4ccc863777b03d815b1b3cc15d8b590657f904c2628fc241bc31bb2f97c4d54fb92a4bc7622970ae5e97", 0xc8}], 0x2, 0x0, 0x0, 0x40480d4}, 0xc000) getgroups(0x9, &(0x7f0000000200)=[0xee00, 0x0, 0x0, 0xffffffffffffffff, 0xee01, 0xee01, 0x0, 0x0, 0xffffffffffffffff]) r5 = getegid() getgroups(0x2, &(0x7f0000000080)=[r5, 0xee00]) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f00000007c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000d80)=@broute={'broute\x00', 0x20, 0x3, 0x660, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000700], 0x0, &(0x7f00000006c0), &(0x7f0000000f40)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001f0000be02000087301300dada6263736630000000000000000000000074756e6c3000000000000000000000006772657461703000000000000000000062637366300000000000000000000000ffffffffffffffffff00ff00ffffffffffffffff00ffffff0000a0000000f000000020010000706b7474797065000000000000000000000000000000000000000000000000000800000000000000020100000000000049444c4554494d4552000000000000000000000000000000000000000000000028000000000000008000000073797a300000000000000000000000000000000000000000000000000906000000000000434c41535349465900000000000000000000000000000000000000000000000008000000000000009b0400000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000a00000001000000ffffffff02000000130000002000000088ff6970365f76746930000000000000000069666230000000000000000000000000696662300000000000000000000000006970365f767469300000000000000000aaaaaaaaaaaaffffff0000ff851f7010384f00ffff00ffff000070000000f8000000280100006d61726b000000000000000000000000000000000000000000000000000000001000000000000000c0ffffff00000000fdffffff000000006c6f67000000000000000000000000000000000000000000000000000000000028000000000000000071962afb0b1e66057b462803df6645d4cd04809ac9b6bd6ea130cc308b130002000000000000004e46515545554500000000000000000000000000000000000000000000000000080000000000000002000000000000000000000001000000e93f6e6c6d6f6e3000000000000000000000626f6e645f736c6176655f31000000006e6c6d6f6e30000000000000000000006272696467655f736c6176655f300000aaaaaaaaaabbff00ffff00ffd33095f8f4db00ffffffffff0000e0000000580200008803000072617465657374000000000000000000000000000000000000000000000000004800000000000000696662300000000000000000000000007465616d30000000000000000000000000000200000000188000000000000000070000000000000006000000000000008b720000000000005345434d41524b000000000000000000000000000000000000000000000000000801006200000000010000000000000073797374656d5f753a6f626a6563745f723a6b6c6f67645f657865635f743a7330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000588c4c5fd3000000000000000000000000000000000000000000000000004552524f520000000000000000000000000000000000000000000000000000002000000000000000fef28b21608541db67fbf903b6c0bef1b8544e107b1d43dd8168d766734700005345434d41524b000000000000000000000000000000000000000000000000000801000000000000010000006222b1657a5d1993d9ea15210000000073797374656d5f753a6f626a6563745f723a7072696e7465725f6465766963655f743a7330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0abddecd92f20701f9566a90a781554842f2eafb62a967b77444ed89d428f9554fbb0797b3769fe9ff861ecfa8521b616c053ea9db3bc9ccbedac0499ea100df2e9dcd3d00e0adea7229ae1db77b122e2e43c328ebe82f227659b61d162acdae08f6950940ee8110b068c1549fcecef0b94956454fc79402a95756d59baf0705eb373052b30a2b1092285062bc27f35f3e6f27df8dd4dcf62427a5d17a5ba1ec72dbe84199a7d095ff4d62db38f7b9adf7070a75f37ed73f3a6527dc8641a5308c6f9af6b962e09ae73033e4d825c79b1ee74f2626e52e4011de01bed2529159eb13a43073b2647c07b50434f9c78238415f2c1aff6886ccd85a7ed266cf65b831e156473dd2c2b5d03e618e17e31932e33f6e9b8774eb903"]}, 0x805) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000700)=@assoc_value={0x0, 0x2}, &(0x7f0000000740)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000780)={r6, 0x0, 0x7f, 0x1, 0x4, 0x830}, 0x14) 03:37:18 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:18 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xa07000, 0x0) 03:37:18 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x72cc, @mcast2, 0x1000}}}, &(0x7f0000000200)=0x84) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000240)={r2, 0x1}, 0x8) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:18 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) sysfs$2(0x2, 0x2, &(0x7f0000000080)=""/81) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:18 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xb05000, 0x0) 03:37:18 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:19 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x1000000, 0x0) 03:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 605.771024][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:37:19 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000280)=0x5) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x2) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x82, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x4000, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000240)={0x6000, &(0x7f0000000080), 0x2, r4, 0x2}) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r1, &(0x7f00000003c0)=""/126, 0xfffffffffffffd2c) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) nanosleep(&(0x7f0000000300)={r5, r6+10000000}, 0x0) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7, 0x488400) dup3(r1, r2, 0x0) 03:37:19 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) fsync(r1) lstat(&(0x7f0000000580)='./file0/file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0xffffffffffffffff, r0, 0x3, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) getsockopt$inet_mreqsrc(r1, 0x0, 0x2b, &(0x7f00000005c0)={@broadcast, @initdev, @local}, &(0x7f0000000140)=0xc) syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0xff, 0x545000) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in=@broadcast, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@remote, @in=@loopback, 0x4e22, 0x0, 0x4e23, 0x0, 0xa, 0x20, 0x80, 0x89, r3, r2}, {0x100000000, 0x0, 0x9, 0x2, 0x0, 0x3768, 0xb763, 0x10000}, {0x80, 0x0, 0x6, 0x80}, 0x3, 0x6e6bb0, 0x2, 0x0, 0x2, 0x3}, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d2, 0xff}, 0x2, @in6=@local, 0x0, 0x4, 0x2, 0xa39, 0x1, 0x100000001, 0x7}}, 0xe8) chmod(&(0x7f00000002c0)='./file0\x00', 0x8a) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$setopts(0x4200, r0, 0x40, 0x20) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:19 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$binder(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:19 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:19 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2000000, 0x0) [ 605.868220][T20634] binder: 20627:20634 got transaction to invalid handle [ 605.876555][T20634] binder: 20627:20634 transaction failed 29201/-22, size 0-0 line 2994 03:37:19 executing program 0: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x321002, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r1}}, 0xc) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1b) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r2, 0x0, 0x0) 03:37:19 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x9940440, 0x0) 03:37:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x5, 0xc000) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f00000000c0)={0x10000000, 0x8000, 0x80, 0x3, 0x4}) 03:37:19 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/current\x00', 0x2, 0x0) write$P9_RSYMLINK(r1, &(0x7f0000000180)={0x14, 0x11, 0x2, {0x40, 0x1, 0x5}}, 0x14) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:19 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xc931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:19 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xb6620c0, 0x0) 03:37:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 606.601009][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 606.701108][T20888] binder: 20886:20888 got transaction to invalid handle [ 606.708267][T20888] binder: 20886:20888 transaction failed 29201/-22, size 0-0 line 2994 03:37:20 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) eventfd2(0x9, 0x1) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x5, 0x400000) setsockopt$rose(r2, 0x104, 0x7, &(0x7f0000000080)=0x20, 0x4) setsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000040)=0x4, 0x1) dup3(r0, r1, 0x0) 03:37:20 executing program 5: syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f00000000c0)=0x8) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r2 = add_key(&(0x7f0000000040)='pkcs7_test\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="b5f376a2826a356c0ff8c22caa9e25e32fb789cab0754392d885aa560f5a4422c5d1f96f8f948fee74157e3ff7ab4bbf98fda6d6fe22ebee310dd3e3d98d2616d729e845e1c02aca0f1424cae80c0240f5f0e752354e89265ec7ad6d7da905f201f6f0e59dde00266c903e7cd0db", 0x6e, 0xfffffffffffffff9) r3 = add_key$user(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000003c0)="b5fa473c5952e160d03e32ffb98b0bb530ddd9201a1394ee50cee81e01e799a232969e43eec3ce9b365a7d0f0e8b25526bafe03cafdb392f91af34935f9bc311958feac54bc85b41952937460cd443b52b0a89b5d60afd2c1573484ced76dbe0590d8da18df6d9d90b6d53455fb805adad34aa3a4cff430a4facd511f30c810ddb9e491a89a696c242ce5d3b2b268b6c96f5a7d6d124f9b593ae790f1c1b139ac81f2bee7a1a2a17b717da665d3427f1cd5fec0993bfd75bed592ce210aa02a83fb5e5bbc443eb18f13210e042fd5f5c8dbb4f55de9b5d15d0d5b265051509854351eae87414951a0f51b50a0af5b261908ba0bb545d47b6c4a7b5d47406501ed1231fa9e3bfd97c936dc98bda2784fe0f012250d366051698e8f2396f44006cecfb064eaf2b48e859efcd3ef8d5f176b3a37a7f36cdc60d17817e6b21c6fc42030b0fe1c16a26e89b05edc34f49dd198a39c90914ad77ac6655624cc5a425d77eec584b219fc8f14c8e5d36f2eddb4ee17a8ce0a7e4c2478efee4f6c8caed71bca6f6d6e5eb25273a0736a0c1694f14e560499f29e4eab88714c8cdcabfb67ae0ab74e6ce7d6fb84e9155500e3f0701ccd6f20fc8084141efe1ff20471d5ff101e183b6f2a0c11851de407e185f342907066353396d48de19e822f67e20fd86c91efacc25b96aac91648af9b2696a669509718e3a275de8521d20efefb8e7c79fe386e27a319ead4d5bcf7b5111ccebcd1a4c76d50074546ed568c915e926a52ecbc0f938111eb58b288dae0c6ad731d2b6198de3fe866eff7142202848b613b2fa51e1003373d2c9091c99637b439b9b5ed48aaa8df8d9469641f6b88b839213d276235bf50e47ea99551cd7d15955b5570c735fb58e18bf35ac5f1e8c900de47fbd7aa47580f8a10c0ef281ed1d59219de3a6b21e1ab6d76e9a963b857be5a3cf269468852680e2bf5ad4a10e74e18469614af1cca9842c96dd42c7e91f600e59788006a1e14caf42275fd94ccb0d25ab1cd0b636ab11c526ef348a9a6c0fc75120ecf9cf2f8bac77234e1c0a8c937b70f5ccf01e6ffe5b0a74a715c5043386c1f8eca9643e15ff2d847d2416a9b5268ced1aa2528d8b06793ee02553ba0ba1b2d610b9c01865877fb6aac67546b4617d209f959626ee8a3e8e92c416f01a82bd9e8da2781995c0b47c4d15dbaa469f53b6a53f47ea377a7fdd909fb39915bebb07b74a83098c4710221c1d3c8a929336224989600ca62fddd3c460d73d4550bca6bc9ea79ee7088c74a434100243b15efff4486a83987a20772fb97e302064317ea510d806b6bcc432e9df199f061e6dd93b41df328dd6440b2078c6e5f3cdddb582eab9bdf6128acdcf30a23700da9b3a1f65c8e8704b9339ef2ac6be88b31c8201bbdb5de518fbc6b09dd9ae517010f14ad1e488b79f7444ee0dd2846d3ff056c3495fd7bd8fb05a82e61cc6d00a79d1c0f4eaa62df7ff4ecc9b8308aa97a943e0bb646bde6947f7563f597dc11204060f7e029f324daa7534cbc4fb0fd25b4a4558ff42b853153740fc2f7d8624f44bd9b400616cb3e1a46b05fda2492a263531d7ddf5389349fa2ea16b9e662f0a31ddb7bfd87861b0d9370643e2b85d542f5b5ba81697cfbd8bdf2f37090ffb6a4989bb24169d594bac9dedeb23b53e0240ff28bc3d4da197b9daaafd19cb7f38bb283308b24d4dfebaeb7562abb2d8959034304f271d262b60e3f1d21c9b4bda50143878d27d2bbfe9ec5bc0b01b809816de94e6c18a7c5986badd4720df2597c2341fd6923454b391023619be522196a559d0f7646a77fa49e5fc82b408d7a03b4790f2e304546cf3216b057dd52a82f9d861d63755701e5f271866902e55b379f91666753005587b82f0ac68441333f1ffdfad8d4ba971f8913f58587780c8273a64c8fd9dc2c8bd4d06006203471ce1f43df316609a375ec882aeb2c9d51740d7846469fcb1d12a20825c774019051aea9ed02460f7185ba0ad4df843367df4c5f18296a1d65d4f4ff61f528ccc9af8eb02d4bad752d598c2789732c309f4a87f4612f4b7cc7e27598e4312d88686f006ac3c94fa5d6f1ad828fff53fe8fadf1a953df657faf9f0c1bb2f186d57f197efbcd660da0aa0641efc5e04617a7f8d5f49177e3caaf38940380d688410a33cd30d268c4ef9869d711bd51fddbffbd1e73902843bae831bc1ace27682e68c2225014ee9f68e223c23c4a206587164a15fa0494682e8a90e89eed7ee444bd8b434d5734b8e2bcc09195c9ffed855047dc2e468652dc0ed5f0664c3c59767d68c719a3c858c4d1d4aa46accd16c7c19dcd6dfe3210d5fe803f94c8a59497319f8fb3bef43d243a9286979ff1d89441f1599ec3d02720a6c4c2665a85cca9f80c34cc4333aeab70d9e4c7e73a576811873adeb63406eb8f6409dbf1be15de93e267f5d3b4a8701c6acc9c52caa42e2b764a8c585b4f6aa37a7211c0ab7539418553ac2acd4c51485d91ff8c53f14d7a07b5213d274b925b73d510a20144264ba7eb51b86641fd364ce333d52d9e7bdcccc6fdbc074da4db37212d3c788f77350300237611faa660f670d93c87dc15d36a05a9dd3cb15b6780e98e475be87f08843364562d4c2dc6e64ebd00eb614dc0e0cd40b67a8a042bccf40321bf2206ffa5e4eb949d2dd2709d35b8819cc9c37a21e1c647e40daf9403fb6aae7a2fcee76f13dad1639922cbe0f1c60ddb9affded120e61b11f492bbf2c1916e24431bc361ff5477989ace303fe8c7ebd20dd93c7bb2814c2d0fdb2755ba44de176ed93630cb1a002c4dba516bfc34c72e5b7752916aae4c637fc592be72f253c6dc448fda20279eae5ac0e06d8546e144eeed088dd46bc594eaa2364d5cf3f4b510caecf8c7d26cea9c68fbd79b6e93de31d370c3ac5c70f3e309dfabe5c774f2a5f6eaed279ac70bad149688c9a12c90770f1526ac53f2eb81aa456d0223cac36d4b2f4265d31feaed6b51b970af6e9d638067de78c4dc39e7fb665ae9df93893c7b718e119fb98b6a126df2eeb1552f9b21b41e298503d84816043cb7f3dfe9cb2285ac7206a4d75cffc35640459b03f146090d59287f399213b3b47fef44f220487b222e782ad3f4a1534d988b815bb99363af8045daca749994209634f435487b31f3855649a4f1e1afd19c5711e4df3077039eb95c20f23c3a9100b4ea5bb58d06d25529928997ba68295602e43c5b1e45d968e3f7b5cf0185b2c3dfdcbdfed6e94d5a27af64305b8c1b05342e4c2d324227c78e1673c61bcd05b38d1ca9acc5c5e8c980112973ff74ac4838922920d17d25698fe61666509f189a8a4ca1c9b89478d2c7214f3cd9f7e76c9e77bc00d752d46392fa5b7d48df26ca12a0b2c3bf385330312b2e272e38599ecefd21f51938488bcd96f72035599f202b39e496c024b4319f970e8eb90c7505f48bbbff9e9c9b565f436622b480acd49791737309ca4c61bf55bb67690a027180caa63fe1293872d4f2b4d8107e5740ba3aa352b949588b24d3089cf536c9e917c1be08c2ad23b9cd3a574485f5ab3c3ad141b3c6af8aee602ce543ce2d3c671e90754b945e27c8703b971c43ad29bac43727482e70452dd08c8283ff316e7abfb1da872b529bcea654bf3f67b1465fd34b9d2553630d31d7aa542e2787b93a7abb7810ff67208705f390ff16ade79eabff6e6da0bbad4cf82e40d756be246f8bcf3b8ed24678e4986c0bf1732744db51439876edc02ab6d08d86c469206a955df0e2864472e4bfb1350e3806ca2e1113c1a328eff66fd352c9441bc6ce13305cbba0e3bbf6c118347b28a8d4261ea8c0b7e9072ed0f27e763a20c1846df15c43250503eae843014de93da6ddb3f3d2050a0711b17f3ad82c506cc746136d08a5e9c5d506c762dd9efd1b2ea121eecdc9018cd09e7f2f3a6ea4874707ec35f0c74ed287ccd408b35da9bf090782ad1bac00b0bdc6b67caff35430487f9135a53c1ff0cabbde008b08aaf12c282fc7937ee50a55c91ee7f2184b4690ef394d9d71c82add9c66f1c69df8ac9068c8887e14d660f517d1cc5a298f8b4b573003fa82d85a8cb37a248144bded526d0982043c39be02781f90a0840c9c678d9e3c8909ad60cac91597a8cd5443a2917ed3f7a1f79da85c2d3c64c0dab90dbca31256a33ce274a6056fefc9693f94badf589d8cfe75698824c9983973b802a0bb82ad208cb8c059f3449568d1b77990bb38140d05f8b44c4e18843c7c105bef2752b2cf270f1059f9fb086f1370a210d54388428a7085f9bb0902649d8bd42b1627e35975012b6d39d57e7dd4d74bd7b4c0dd824ac1dc520945b8091901180309f42de65240a1e70f2941a2a82c50c6c6d1ffefef62aa140469255e0147f662f218ef652cfddcf2fcd8a52c6f9fdc869a75787eb38bf18d274561e3833c7acd953fa71e9a2205534f9a3c95c0abdef870fac821ba20890cf8a7f51dd741ec83db7431c616c0d96503ee46f5334c0418c3fe1fd4a6c2c42dd6576f5311827b2a5aa95ea32a189d1f7cb4426851c9cfbb9441be4611aa83204352680e1a408652df3ed45cb87d57bff10961f445653b29e596e3f0b903a69074aa2512ff96209a0b409604ef8c3d3720fdc9b94aa417260d386674625fff06b9dd4dd1b33f376034159033e37e2c8ccac33d8d9d465ffa49cef89b427c200c6fa84bb8ae965bb9c91103f2974eacc4a50a93a146cfeedc06dbf937ed73f21121d755a21f6f727423df77d9a5c4696176d1f822793fe91851bfd1f0f20d8c5c12273759b3b697c8cc8b4cb7413b48c585daa30ba28c33fd6ab0dba7df47e8bbcfef9d80d6091b603e2636d82274ec571d73b0a00f036a1c5b6ee326c06c89f84cf606824bc43b4d66616fd7ff846f3b2f9ce5580fa1eb33b2c8ce25141f207edbd6edd1f3ad210fbf9ed496a0ae5e0d44c4a725fb6cad9fd4e37b1e1acaf56740919d6e90bcf2c9567ea0816183ccbc282d777966a2279f7e02f28da297e86a6395cea4724850ca4863eba356e6f5f4769996b71147ea16c8c1928eb95cf65146630ca1359fe71b7ce6ef755402d62350f5011d60183716e1ed2e09eb4b9aeadd29470fb192bf062eb9ab2046fdcdfc1c3a467912b18057b7ac12025a3bbe246a894695be4d5b0f40351956f21d7ac62180951c20ff8e5c899a1d87791d9d420b4dd3cc1cca9f4de198973de8713ee7e5119235bd26cfe2423e06264acc88e0b032d1c1e805665c254ad410149d5f86c0f2226612185ac5b2eed01363e1018670818068947a6f806359e7584719626009086cae7dc29591fa87c08ec729ab46b549d27e67d7f0791406a991def42ff9559796c0ba94d5b6b76643575425b19303878088fbd1cc7248dca61c964fa7551eb60e107e31f3f51c06ba0d4dea073956dea7b0f797aac955ad2e5b0c010cf76aa857521660c9dca250d7a888faa35add760800b390b2425777f21d961882cbe8a6e281b3c8c8cc4e953e1d70360487c95a0bf9a85a21b46d57d0057086b888f7a806d3dc1e37a4ce48d06bd31219da6e7d4943b27cb9577d9d9ca4d625d2325c9eef1a8c0ba69619ead084a1ea9260cf3ac3a1a53faae3c1ca17bbeab43e0fb2b8554af1d11db81c073bc62da0e971ae084be62cb9d11740ffa6114eacb69751139d22f4c877da414f01b6a03fd5325fa69932a78932d3c8216fe2f3a380c8ca65e9e181d1f44be8072d69fe68ec6cff5c19d294e5e24c28174e42dbb360d13ff8ef803ae7058f4b06f1ca3bc6be7", 0x1000, 0xfffffffffffffffc) keyctl$instantiate_iov(0x14, r2, &(0x7f0000000300)=[{&(0x7f0000000280)="545c10c620a351b24953380ece3ae4aef2143d53fa41bedc4066979727c67c9cc69aaf4828562c1cb47bf241faff8a0fff212fbbbfd6e83eb7b0748fa5bbd2fb923165c91d86954f5a2616175352e950e1213c47ad6781fda50cbbf19a1af7597c9e585a", 0x64}], 0x1, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) write$vhci(r0, &(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, "92c45b6cb8844ef6ea2db2030455a05a4a57e82f661a75b54ca149311203a3894f4663"}, 0x24) openat$cgroup_type(r0, &(0x7f00000013c0)='cgroup.type\x00', 0x2, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0xd) 03:37:20 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) sched_getaffinity(r0, 0x8, &(0x7f00000000c0)) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000140)={[], 0x0, 0x0, 0xff, 0x437, 0xf}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:20 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xd942040, 0x0) 03:37:20 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xca31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:20 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x1b540000, 0x0) 03:37:20 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket$inet_smc(0x2b, 0x1, 0x0) wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x2001fd, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000000)={0x30, 0x5, 0x0, {0x0, 0x3, 0x8001}}, 0x30) ptrace$cont(0x1f, r0, 0x0, 0x0) eventfd(0x99c1) 03:37:20 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:20 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcb31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:20 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000140)={@dev, @loopback}, &(0x7f0000000180)=0xc) r2 = inotify_init() fcntl$lock(r2, 0x26, &(0x7f00000001c0)={0x0, 0x0, 0xed, 0x1, r0}) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) prctl$PR_GET_FP_MODE(0x2e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:20 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x21540000, 0x0) 03:37:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 607.428907][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 607.535094][T21148] binder: 21146:21148 got transaction to invalid handle [ 607.542287][T21148] binder: 21146:21148 transaction failed 29201/-22, size 0-0 line 2994 03:37:21 executing program 2: r0 = userfaultfd(0xfffffffffffffffc) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f0000000380)="38b7ce4dcc3000a12bf2764844a1788300000000000000000000000000000000000000130000000000", 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) fcntl$setflags(r0, 0x2, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x6, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0xb) r3 = msgget$private(0x0, 0x108) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000240)=""/226) dup3(r0, r1, 0x0) 03:37:21 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$KVM_SMI(r1, 0xaeb7) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:21 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x28583040, 0x0) 03:37:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcc31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:21 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2a583040, 0x0) 03:37:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x100, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000180)={0x0, 0x0, 0x9, 0x4}) wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) accept4$llc(r2, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000280)=0x10, 0x80000) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:21 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x200, 0x0) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f00000000c0)='/dev/binder#\x00', 0xd) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:21 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcd31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:21 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x369418c0, 0x0) 03:37:21 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x400000, 0x0) r1 = gettid() write$P9_RGETLOCK(r0, &(0x7f00000001c0)={0x25, 0x37, 0x1, {0x3, 0x1, 0x0, r1, 0x7, '+,nodev'}}, 0x25) r2 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1b) ptrace$cont(0x18, r2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x87, @local, 0x4e21, 0x3, 'rr\x00', 0x37, 0x8, 0x31}, {@broadcast, 0x4e21, 0x12007, 0x7fffffff, 0x80000000, 0x81}}, 0x44) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r2, 0x0, 0x0) 03:37:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 608.266773][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 [ 608.383118][T21408] binder: 21406:21408 got transaction to invalid handle [ 608.390324][T21408] binder: 21406:21408 transaction failed 29201/-22, size 0-0 line 2994 03:37:22 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) r1 = getpgid(0xffffffffffffffff) capset(&(0x7f0000000000)={0x39980732, r1}, &(0x7f0000000040)={0x4, 0x788, 0x42, 0x77, 0x7, 0x7ff}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r2, 0x0) 03:37:22 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0xffffffffffffffc0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r0 = syz_open_dev$sndmidi(&(0x7f00000000c0)='/dev/snd/midiC#D#\x00', 0xa2, 0x40000) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x40100, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000001c0)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f00000002c0)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f0000000300)={@dev, 0x0}, &(0x7f0000000340)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000440)={{{@in6=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000540)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000600)={0x0, @local, @loopback}, &(0x7f0000000640)=0xc) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000840)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000880)={0x0, @multicast1, @loopback}, &(0x7f00000008c0)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000900)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@initdev}}, &(0x7f0000000a00)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000a40)={0x0, @remote, @dev}, &(0x7f0000000a80)=0xc) accept4$packet(0xffffffffffffff9c, &(0x7f0000000ac0)={0x11, 0x0, 0x0}, &(0x7f0000000b00)=0x14, 0x800) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000001040)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001000)={&(0x7f0000000b40)=ANY=[@ANYBLOB="98040000", @ANYRES16=r2, @ANYBLOB="080025bd7000fbdbdf250100000008000100", @ANYRES32=r3, @ANYBLOB="e80102003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r4, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000400000008000600", @ANYRES32=r5, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040008000000080007000000000038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400f9ffffff38000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000008000300030000000800040006000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000800000008000600", @ANYRES32=r6, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000200000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000008000100", @ANYRES32=r7, @ANYBLOB="2801020038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000001000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004005cec000040000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000600000008000100", @ANYRES32=r9, @ANYBLOB="9400020054000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000024000400ffff09010200000005001f06e0ffffff020000074b870000ff070709050000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="7c000200400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000100000008000600", @ANYRES32=r12, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000900000008000100", @ANYRES32=r13, @ANYBLOB="e400020038000104000000000000006966795f70656572735f696e74657276616c000000000000000000000008000300030000000800040002000000"], 0x498}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x6) 03:37:22 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x3f000000, 0x0) 03:37:22 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:22 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xce31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:22 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x40049409, 0x0) 03:37:22 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) sendto$netrom(r1, &(0x7f0000000140)="a746df3970142de973f1fd0b30f9b1b4c75f401507cf2a464954fed2411170940d55a4ac7c9ff948c21bd15346f8d5725f3655db8bb3aa8b7474670b926bb18faac47408e26eb3e4fe346325f12fb2af01a67429cddc1f3ce7a96e7bda39a2c2d2b87d7c43c409ad2976a9618196a333422be35f8bde043c2256efc795b69a6da78e9f7420cc4124d87d0de63aeb15eaa99d50b0b64356b5e6523e3a2982c86608888c90fb878f3aa6d300b6ca2ceb48c93d9244665ffa51f7404004a5cbf95760f38d4cd56784c3500f044f3426560edf7f8f80184008c38715a030777fa7c17027ab12b4f54cb2bbc339f7a70ae6e0fabed7d79014bfae4406441b2392b262a5dd5b07faa8532aa55a1ed6f757ba796efd88d10022849121b8cac57f35a6934f0cef3e62e2eb1192c7cd95e02f0feeea25abed10660f7c89369cdea0ffc0a464fb27ff13fa121c5ef215ed1caaeaa6b93c249c33d3155e92e2691db5dcd1488062e3fa678443780f999418b7480b6d766f80f2de4a3816a48c7bcd3039b6a83be9cbf21cd6bf6b816fd8c083281509eb12e51319e14913b74180948d28bc01e9b3fd9e4c69fb311ee982a9cf2ffe171298d305822b326dfba08479784c6e3b2067071f7140d87b5c7b1438656a2449bc7ebfcc58589e981daceefa2936eb9caadff3576b4acb3cc8175e8a190c49b08a9e47b6fec4b46458fa7bc1a60aec9e39ee311879469545ac642741a50b4b2104f2e49078e8be56742b666dfa02338867f3ffea9214a96f4152ed83bf426dfcb19ccb13d12795f9b9d92ada93c94446bac2d207fe3b672aaffc6c6dc1159eb8bb08074021a0dc5f4b3688e848821a92ec987695b161bc894f8fed9a16679199a7c177eac992ca8dcc0d6bd62927dc18c21a1cfc92d793fa3176e0c2c505ab16de91c457a6c66134dfe97a6a2c35b8c0ce5f1ac781cdc647481a6672c33fd8bea85ddccb7b6ba5e3da8c655de272f2d1cf901516c98cd95be3a402060f1b7fb06604c692fd767dfbd24b42aaefffd8cbd75bf2df989a7c76152b9328e53e219439fb8fa99bc1ffb18f0751870de2735138172f423e8efe5b3759b045ed9153b6dbcc32987773978d86ec68cd0c9f63ab15923fb9f8fcac0f65787b9b9451101307f774182a9bd83085e18264036704de235dae80081dda50bdf2d0d1e579a93e049299631bbdeaac30f418900073784496160f02e975cb82b9690d804003fc8990746977b835f3de4119556dcfbdfbe0a59700dacdb5a35d5499a24c053916c73e6e072c63a1531c31ce5481c285aa0f110590d851b9e2c026f4d7971417db71fdf3fc4d9b972c5929b1371c4f958759208b57444fbfe4b47c6fa41da5eee068405083f36102a27de85f71333fc6c3bb9a32f7e268bde1fe6aaa0cc5d20409c3ddbc6e0cc1e2ad33b796bf2051a13f0a48379adc1397f31d9b11b021b70cf986ea0c1db16e70fbf9fcbbd228925ccc741de3eba4d84feef4089b24cd3831e81f29d45f98119694c9bb5472a4d27fedbbf2fb4fdf62f5d7a147e46c9c714d178f7d6a13ad44bd82324a38b477dbd118e32d36aa12a9b00396105835be9c4b957c377aa787eaa7cc3fad20d70782738b647d905efc8c61a534312f9d14b03db9ac7d70abd20162ae5d367e743615497fd18911750668cbcb03199e3c1696603e65171946b2792e182df6afdd1f192fa9c7097388adae58207be8174b4e83e02e2f1a987621d61a4cb0c2e845cd448207a2835c4d15cbf4fdd3f3c9213639eadca14c5f899da9caf1c0e8e41438fa8ac5d822f884f0da8729f64e1e098360295fe86824031548b87acdaa016f9393a9ddc9170023e63d47ccde9efec1e243120d3378e376e91a554bc0404a4514cd10fdbf7a1cb4f7328e0daaf54f7d58e2f31427b682a4eba162a667a9986c7a7fe59f50a7acad523b4318b98bfb7ea2092e87f4af60ce2186413e8a837825425dfff7aa0f76339f8496b732b828bb6c599386935bf1a8899765922a16b494a07bb51cdd092cf0b4f0dcb26b50074f5ab0bf888463227491c45277fcf7312f3c890ea4d47c271b2f2845b0d297032f1d2315b93a3c73eb41e2a23762943d841b0c7ec1d4c71a7243d67a77a04a65344a065b4945118b88b1b71e112ea1484ae3bbe3faeda7dd38db578c8a18b5bf7c2850d5fcc2cb1e451f8706e153a7863a5819e7828074bf6952d42c6df73c4f1e148173121e1a9af484e9dfc5b53e0f3200a806cda8656fc6dfa6fb54b56b4c101819d7d4db7be92875d9e0c2c441b46fcef922fe5c5f505eb8829480417859ba2386786c895cc45d1bc2373d14755e2310ffd5a3a4d79b04a77175364726a8465d73451e207e6e0f4536186072862bcd8deb464e798eabd10a7e6e07d90f825006ee934499471dd93571720efda4057e2b2bc8a2b6ba0e351e42c7e987542defcb881e8bdb4e24af06d7f4845ef26f0bb290ae7936ca9b6f77a287d6689131523559c62b3e4472ec74a585d7ae1fbe9b4a94862cd2578691f17d83222acdde5ee144fa491207ed90b1096fba81c892df9558f99d063654cbf478a881c96bf3d5bd3947179d18eae13f6d21dc30df811d62978916957a67b0bf79e6b3b87e5f456beb85a81907ef0d70a998bc3c9a7f850ba3deaff7d3ffda02fd03d611e24b38cff8590b66816266a670fd622a43e8ec4dcd6442838a7fab9b628f16db13364067220d091b884d841ffdbc3676916bbc146e7105993d336642d443c355c10383b080006d05fb3396736c25d5b0727bfdd0ec8de3ec45f46f15788a2b9af822a7885ab3bc52168930bc5f80526c007a6f4dcb7fc99b5282c4339c8e263d86addb64451742d528732406dd34b2ec1c26d2ceea76a3346a3526dc5058f128b66f184b091d0b90f5cb185543f47f195cfd1ae8efe8cec539221cb8f6b9425185f7af02ab1133da792195ae96af0a1607ef0ee23cfa1cdfb78a2db7b9e5c2269514cc24bde0cf2721031968de8a145501c943014ee5734ff740ca64fc34b171fc16a8d5e19fa07b15191f6208de577e981da351b77bd97f26eab53ad3def49e7961fc6ec1df825c1e7e04947b284554eb4537e96ef0b56f8b4f2d2b1a5172a1c3a284d5eb424c808365a840239608040a31d17dd37f5ccd565aeb1908ec674e092c9e834958173fb0a310324cb59fa0f91c33a75dfd5894ed1b31a13195c7781447d7e392e9a0480962c8fa4cfd01ac68543bc6ab9490d181fa7da375e40ec16f6d2cc0612e0feb52436a984f5f56952d359a4414acd3c69e2bea5a1d2c7cd4474cc9a2067bc41ceae829f4ac7b1734c090a940b12548fe75e99937366d179c485a2568a867396151a4ffd33d9194e1e5305f61aaeab326aeb2f496eb00b5e2335faa88fb97f77a3d87f2d3d3b6b57903dbac00cf7fa5d7cfe10d980a8aa8c2716edadd99cf19f169072a225caf0ed42096c494f8d775fcc4ce3e7d7a2ee1c3b430b0226f170abd5e98bfd6c4d68e0c2049ae27b39b391f805d68a644f9a7eb4f4201cad7dee6de2fbc015c166a17aa37f67a6ce78bdca1bf5c3e72c16291b2d73a8356b46718e1e2723a2e5e670c59e4d05b45549883dd7b70a49c3d0f52c3afec05bcc719998c05176deac84b94803c6c3d184e441a55e0c158e3227afa4eb8d5bdf5f8d1ffe950cfe749da70987d4eb7999421d016179fae1cc582d3b99ee29cf5ef58f3fb70719af0766ce85933c21b280fde4c9ca39678814f2c2eb94a50fd7c687eb67aa9f2c608388b6b1a11e04d479a71ca5d319d593fe98d15083a70b3de581203591ff86490a44715a0b0b2805016d8b5aed07c97bfe3081ed6a3e9ecba8174c7ff9600de361c088f84e28cf832ff08e26601fd28fcbb0b75488b23c91f90c754164f39a0bf71859b784008f394b846b05e0dc8e5f7d43b0b08910b33643b4c69e8fa1fc3f0b99a06b67cf80e24f2466ad6a4300f9e557fd008cffc68a54688a119064224b0c73245145df4816ad83b23e6efe6f13176d7309a9eaddbf086716584cbf9f0f4a599c11bf36beb7c1bf25065ed05817018dfa2e8acc4269a2c7dc118207967a868c3837f22f31d62a083e8c57c6bef3d665a7aaac9a1efdb8a3eee37eee70110d0af82c3e77feb429115517c18d5dc202665073f615da9f04e1535e7471ac64dec64a54ac9cb1af4907d5a02cf08919cc6115eb2e80ad7e8f97e1117ff757b6bfc759cffbbd4484d656c28eead49f574221cbe72b74237802e97ff5da389effcd072c1ee4b66cfc9ee0f6c2be5314638c9fb2d5de9aee2d12d875fa2c815f20853844ae02927cfc85c13c166acc95d416be87cca6bada93193095027343cefe6622c0edd2919aa9058e2c2c19963abcaf4c1da3064a0f64c41b7220216ace74d48e0eedad1942747d7114d0644273763b6072a74f22eef4231820b31485f3fafcf80ecfbcd7d1f6cefc4009f93901d03e67715462f0ef8d929b91d74ca93d9da06b1effbe736de082acf594318b040e4324ba9d17cbc3ce03a63143bcce7bc26fb96fe858e18f73d121e2b4c86f6368cd0bf1e442c65c1094c8478cb7369f90808af6b92750333e6c7451ab4ad77f6cb982b2ee650b951b1cc1be6d2e173522dff8d37cf520589d1f1f8f530fbfdc8d989e67afb5fff4528dbf2698c234ac2eb7fdf9cdd0f6afef9a9e336301e60d4d610715aeec915e2513c241258668aff7a4afa6c5e5763dfa839757052255d38abf1d8749900f2383a57adf812fa3a221c4f8f391a385834ae92f1152fcafba3bc8954e97fe605f9639441fa47260718f1febcbea66c0152e1889c59af6257fe942fa088bcf7362266f491dd07e1b741e5362b8c733bb178d0154da00d5bbbc54fb1364c8da8c22665798f53243c08a4e57ef3669d3d683958d28bc801404d58d5069d7fab49b4b323bad4364cc6ed9f9e50533f40374ac8618d3449f53663a65f628359353464dfbd24b57d099caf88c77a1bee15663bfbe3c71d98fea7bd94789207cd982dfbf6d8e627df3d4bc14bb53d2f3043c77af3d5a536f43894b5e688fcde9284e8e653f778bbfa36a59acbd14bac7115c2126348bd6513c0a15bff2297086c24a08ee30e4039d314db1559091db2c7c000d0bc274ac4d8de444172ec177ded23c81b296236f294de44bd03f640d33412a7b6cd567755a8a610844983d97a8729531533e5ebd9c48deb513d60c13d7db2d5a2c67b48b752776a8d8135a6115cf01331feba88374fb6b943090d30a0111e21d00afe76c696984c746b5aeda86759cb2caa6adadebd116180fc2855f2984c286820a3e7bb73cadce3f18516659a6f4e3024f11baba91388103dad10527e406b126d098d7df995b9dc94ba1224ed6bd2a31b3646db5964e664e48f0f908c5cb1243808f612746633814e1b755b735da888843f591e0168a18dbeee38687107881ccd1a3d9270a8ad9c6664fc7a92c2ce14c32f64a337f434f489ffb0ced8bf292a5fd507366ace11a3eee3ef97ae26bf45f89819b350fc28062cf2ccb45bfc8dc715d3456d22b33e199413689ac1fe288a080a7a8aad0f3110ff937e46d8df8c33be6c5b5b2be9eb24fc2f3935d67da40ddd1e2841ca4db18da9d1c5e02b954847e091ac9e661ab15cff92611a20f8231a349e40710ebda064656a17ac4fd35b1e0e3206338e1f685f152cc8deae90824acf1534c5c355811ec928b0a2d9d621c700393fbbb805cf4e5fefe35ddf27039277e699e1a2369e5dc112ae79c22ad30bfbeec20fdd99b2", 0x1000, 0x44000, &(0x7f0000001140)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x1}, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) sched_yield() ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f00000011c0)={r2, 0x0, 0x20, 0x24, 0x3}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000001240)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r1, &(0x7f0000001300)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x80100}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x2c, r3, 0xa00, 0x70bd2c, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x2}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x3ff}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40084}, 0x4) 03:37:22 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x400, 0x8000) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r1, 0x10, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000081}, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:22 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xcf31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:22 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x1, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000100)={&(0x7f0000000080)='./file0\x00', r1}, 0x10) 03:37:22 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x4020940d, 0x0) 03:37:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 609.115342][ T7868] binder: undelivered TRANSACTION_ERROR: 29201 [ 609.323155][T21769] binder: 21668:21769 got transaction to invalid handle [ 609.330352][T21769] binder: 21668:21769 transaction failed 29201/-22, size 0-0 line 2994 03:37:23 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e3000/0x4000)=nil, 0x4000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2000, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r2, 0x40106410, &(0x7f0000000040)={0xbb, &(0x7f0000000240)="05d63fa849d98611e338dec70da3ca9556c27bc13ba75210390ec72d6ba7c534cf021d4824e1887e9b6fd2bb3bfd550bb4756982d53692804cdf172bb11c3de2ec871cd3088530c39c983583985e706c2ef05bce6f8680ca68d6db2b29276ce9880136488fd4fddbfdf10d927e2fa9622ddb73260caef95b56a8a929c54160fbe6625178f3c51508e3b7677b1516ac82b9efbc8992a63c00ad840c55eef7cd44991506134efff2cfe7252a9741d0eed73649b54fc84ef579fd33e1"}) syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x87, 0x7510d04c5c16e6ee) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:23 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000140), 0x4) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) io_setup(0x400, &(0x7f0000000180)=0x0) io_cancel(r3, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x6, 0x1, r0, &(0x7f00000001c0)="70a6c0d6694590833349c617cc873c2de203546f390d92ec081f8189708f727148d85b908ff57b00f70e90eead2f79eeab09b8aebb16d38e567e76d6cc7f203f19af6790ddc5db643f31082faf4ff73b1e455735040924eadbcc6205bd1eb69c4808f5fe73f0d309b8d972676fc95054e8edf077056c57629b19", 0x7a, 0x20, 0x0, 0x0, r2}, &(0x7f0000000280)) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) 03:37:23 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x40305828, 0x0) 03:37:23 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:23 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000000c0)='\x00\x00'}) 03:37:23 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:23 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x4030582a, 0x0) 03:37:23 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x6240, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f00000000c0)={0x7, 0x7, 0xec9b, 0x200}) utimes(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={{0x0, 0x2710}}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:23 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:23 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) ptrace$setopts(0x4206, r0, 0x7, 0x2) inotify_init() setsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000140)={0xff, 0x400}, 0x2) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xf, r0, 0xfffffffffffffffd, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) tkill(r0, 0x1) 03:37:23 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x50540000, 0x0) 03:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 609.987005][ T7868] binder: undelivered TRANSACTION_ERROR: 29201 [ 610.255186][T22032] binder: 22024:22032 got transaction to invalid handle [ 610.262353][T22032] binder: 22024:22032 transaction failed 29201/-22, size 0-0 line 2994 03:37:24 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e2000/0x2000)=nil, 0x2000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x200, 0x0) close(r2) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000300)={0x5, &(0x7f0000000140)=[{}, {}, {}, {0x0}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r2, 0xc010641d, &(0x7f00000003c0)={r3, &(0x7f0000000340)=""/106}) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r4 = dup3(r0, r1, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r4, 0xc0905664, &(0x7f0000000240)={0x0, 0x0, [], @raw_data=[0x8001, 0x3, 0x3, 0x8d, 0xbfe0e2f, 0x20, 0x4, 0x3, 0x3, 0x23a, 0x800, 0x80000001, 0xffff, 0x1, 0x0, 0x6, 0xffffffff, 0x80000001, 0x0, 0x4, 0x1, 0x6, 0x3cf, 0x4, 0x3, 0x26978000000, 0x4, 0x7, 0x80000000, 0x4, 0x3, 0x5]}) accept4$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0x14, 0x800) 03:37:24 executing program 5: syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x40000000000) open$dir(&(0x7f0000000080)='./file0\x00', 0x2, 0x100) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:24 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x400000, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:24 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x51540000, 0x0) 03:37:24 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:24 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:24 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x800, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x80000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001240)={0x54, 0x0, &(0x7f00000001c0)=[@increfs, @transaction_sg={0x40486311, {{0x2, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x18, 0x30, &(0x7f0000000100)=[@fd={0x66642a85, 0x0, r1}], &(0x7f0000000180)=[0x48, 0x70, 0x20, 0x28, 0x20, 0x40]}}}], 0x714, 0x0, &(0x7f0000001280)="c206424dd96a6c9c3449ed8c89e706ccd23db40c9444fa91cf99cc60fd7ae9611bc7ae32637f286e2a3eec061f11fc870739ba92d3f939248497221ce69b2158d6019e956b6b26a961f7ae03459d90ab1596127378b40c1a96b5f27db0f9e53533e3e9ddca10f735a423e27626bbf533a5ffde4320f3e5b6456c52bf82a3ec88a6e5fa06599432f6a11c067a678597e247ca08270ec5856a18d4548e6ff8af0395ff87ac94f6dad5679179979d07a0fd88ab3e8db1a05b2671a9ebc5058df5b7b262cc3e00af106a254361c54f0eadc50919e2ed1e3f5ce8e5d10dac5fb8264b7123a219ea703bfbecc62278b09ed281c72fc0736ee6e788fb5de128553f9640119e2531ea00038d6fde3b2cc4a913356d0afeac840342668b3ca6c32d4605116e501755cf00caab4fd31e1f3bc215e7adb9d5536122f83cbd7b4dd60d51587f2fbb86593a9786b478e2061cdf4850b5fef290055ffa774c48be739d2fb7bf4f6fc56ae8a4bd730e52080a23b7c115767e9e1e1d7ab88ca52a1eb6eb0ccb7579c5475e68e56bc305a8e101f310b17dcd435559c6c9d7ba239574c6756872aa081a4350adb39c0e22fdf9895be87102025f4d68ae1bc9aea490b48b3393ee6786863d4416996d9278470ac614d8994c16c8daf59fe6822155625f7e15e78573c175a2b2cabf98dd6813a6e32d96e549c3a08613b1df6d491789c22d912ea20b50c8e517ed55eb266305a7e44b8d0c56b5fe6487dd410c16b232f7225afd40146609866ff531a69af3748f44dac52788da897f68e21ed2f13191e128b555cc94f5dcb4b1249b9427a823fa19ffbf84d4173aefcf18acb74eacd3f22f4dda123f12bb403f696fcc96ac95364bfc853583928d23d1ff2c9e4e42a71e68089ea123313e2dd1829ca227b6e31724d6fd09537db380da31621e8f479ccbfde88f310a53cfe1ebc531f0801b1a44770c13f91dbf9e2db7c961c0b6a4d7ef763954cda636e5482a32be12ff52c8732bb1ee88210c86648065097e24d8e59aca48b8c421f3fbc3e14e341878c27168dae59b7e67ba8b7ecac0904403f53c6735522546e8dec22832a7a7b942b1a8035aca99cea094fb0672c98db011970cf16dead982c40917caa2878c51763cf694bc7169ab061e7fec738e348e8f7fc4813ca392ec73fafe2c98525259cddef7b45ad853284e5b249d281f0b821c220604226f3e55c4e6b65f20b919af44bd8b0f1ff4f6ee47ad1db9edc46db13222e83cf979438a47f1e3a479a100f74a9e16c63ea3cab489d0ea138032a595dfe43231ee32285588823839da15c9e9d30829a2e7dd31dfe708465fe64abfa93cc8da8de2a7c3d2498d8409155c87d4ce09ace2132efb6a4425d40465a5eb4bb729707f5f387d6402e754e5cd65d0cc83ccbae68edafa359265485589aa26ee3b0e3638dd4357458782fedc2b7e5c9e6701eec6c31dc42749472b2bd64d71555dd3653336eeb9005526d2401d0c36202959a1d205468326998ce40d6a8809ada7d89b74aaa4f6dc6c7cc032b6332611f6a226a8aed388dbaf148012dd78c09c7057a12445897b5f7916403c8a7d0b31e521c9ea50af7b950ac34a3d3d62c62f6277b4ad6a1d350b5550338dae1f6a07a4a7b22c17bea0cb65d0714b879773f128dc803e7b94705ea965849b381bc6cc3d03de4c30adb7fc6cc371085186cc1795a6fb59f0c2ef70f2a24986c956165655d2ff258a68dd4765d6b1560942fbd617762815eab2cf1e9b8252a587024813019b4195555c41d0e2b5672e162f8460132098b8cf1d0c04896147331abb9ba60a5653ae44f03c750525afb5a58d3e13423ef165ff17eb6a5e2f8f565e955f70a7264791e42576da0ddc8b52a5278a5af80ef36b1bbe0aa519954fc55c9ea1826f1841765a45235e96f8fa8bf246782a07330a5cfbd41a70ba723cb2b98431034d195afcefdf581cf4751db305182e1dc9f21237d429323f9e228dedc4c9b43c6c580c711ed3c83b29d53da71be3adf9876929efd0aaaa13c564fc0a9edaf141d01f90da17cfbdbebace03adbb439ee2ee430801bb6f037ce3232392c26b3611d421b61b4de7b0361d105c374a370849793e0ff89ecef22439487b2af8093945742e3c66b8b56659ee8695d2d82c9727f734cc30c87eb1c9521bee4243e01857693dc3809500fdf30dd0c12d7eda64d86fe4e4355608c38502892fc4112c620c1def210593fa822f903233f5fb4ae0179918a5a6c9628979c261c158b875f30e27b3f4814616f49d0a62ebd970828cdd91a6501fb9b28baae094d426094fe4e02bf6f9cd7abffc63b7e59d12002ada8fd6b34c91eaa8dfae43c6b53abf3b3857766ac5187d584fcbcc8230f875ce765b1508ccb71515af34b7ea07f4db42f5a49cae11d8c258865a274576d9825e7662997144d664932f36d5fb0a8d2ac6758404b82d59b037040e3f2d6060f4889b988989ce203882f30687519d0b56b53eadf12b6b26b73f9958f5aa9402c16bfb6221f46cb8fa291410bf7322cdee9ef8d42bd680fcdd7f7b1e8dc32340c810f7aefe6497b4438570ef9657568a849531baab6e0a6f9d334f295cb3e038060c02798345040bb763181eb2e3d8baf7435de2b2dbaefb020a326c2e2a90d8873dd6072ec06bc49e531a7dfe519505940b299733e4559510f62790d08f4a79b34763271e1c5bf9e5652a5a92473cfca8609a81b51e4531b76183ed8ace195b624a96316569d6e0d688fd69601c478c961751e673577e27fd3873462db276fa3a536cfcd8a60a0dacdcc940cd64f8305eb461c47bf36d33b5bcaf23abf3af0fa559e43e7617ef0282e377a230cc1a252aa8c507f096faedf400be1cdbc5f8b9ee03aec6171a1a3bd162535fbdf2b432dcb3adcb82b1cf8487b7e7cfdec220dd118c81e71733d73c6be1fc5e41b155e5acff22cccfb480e49bf4bc8efff38ea0c28ddeaaf8ba67a93d90588971d7ded842405276a7bfabbcc11dbc07a447b5b0e78e6b55167f0b7679b4d485871d6cd4b89f943f45f24001c49b47284dbf7f14e0f8e4987b171aab9ed47c291aff545ca5155480163f21eff46795ba8cc53c38468877349a5ac40e9341da454e4c26d2d05558bde45aeb1df6cb2508cb4bf5b80e23f4e28dc47737d988e253db01d87f491f3398f3d27385cca93f81266b76f95b38433878c88557db956bf2ea612e6f4bdeb15aa93b2f6c5ad2ae432460c590f4a104da0fbd4d1002a3357607e2b9d3fce4a84a7429f2dd9457bc7ba533cc37915315463cc6883317b7edbdcae84f4ba48710869f458c887370ef3b8ca2124a6e4797ab559ed5b8678efa44df9dfee556003acfd664e11ee9d7e94d3306d99f443ea3736b1477a5e6d52d7b7ac715a44ee063962b977be9f6f4d26249aa5e35e4b04d92a4dca68386358bdd80a44a04a911b28f078686b8deeefdd8ddfa385b69a88fd7c51a4bd8520d85479e6580337ca46a2a104855c618c6ad086fde24ae0fa75d877d4f1f8a7011482359615189c437ba28c7e25a872e0018b2e3267a8bc7ad4652b44fcb59eaf603d1c863671e59f6baf956bdf93cb95e82f6c103bc90b9e10f17c4801c06f4573c0e5f6ced5ca8458878328de44a4875ea62287ddcf42769e080f17e369fb95e978adf9e642aebf217903aaaf93df0c7da99b07af7f5a489c6879d8e470f6bea122008a7c73cf3334e8741508bc9b925abd509d857ede904c651eaf09fb2813c36a640e839b653f20925253a98ff5dcda40c3d9aa42630d0c77bca03d3e7caf25314139f900a34067c1d4725c1427843c48bd10e450d9187bcab4a6f30c44937776fafbbd27b9bbb1e369770d70cf60e142a8f541568c2e7f981a91bbfcf7bed4b3426dcb3dd4da4e7a379be51e326b73a96e3d9753182a8d03640e18df85caa2a32b2378220a11c2d5d92d53ec0c080b19097049baea7d02b54541acb8d7d93a3d142e7d68de6119ff471af9d13d1195f075a5424fb809d27153ca9c5bdd22ac9c66300fd26135b01d45265030248f9dfbef55697bf632f2a8f59c001d5d25cbac4fadfe943d355e36fc3cdfba1e21a2d3781cd38bbdef70e5e448f608d6dee9bb3b8c3ab53d1914f3b7bdcce34093eb7dcda0c20ca09683946ebae6eb0b64b8b6ff48de549ad415667c0578c4658ba2edfb625e9fe52ccb2d2bb1ddd29d17287a328cff49b0dcb57920f2b8e199b3285aa76895b17b93e2f8a4b0f16bde1248a8ff1a4f86448267e25182505b6c44d4f94de8511978d9b378b802042d819b194ba3b2edd1e433537d8bdc79a6ce65a82072dea92ebc930f3f278deae90cd46c750f51838175212fa3b9caae1e4542a9c13b06795e53444991d4491390d251a3db969abdee8333ac5eff89731f4bdebddacecde8cc4d35aadb5231ebeeef94ccba8215c75f0b51d29814d52fdba3355527bc8b76fa325e26ca7f0dfd3f0f91f288da46e29e001666f40ec29d9a8035851c43195b7d2bcb21240bab17c8892a1c8967a3e370bbc21f973f0e5eb5f7791e43ce9ec828ad273c8f4f60767f7306ada36877e62dc31a153f42247e6974e7c48917c80bddda0d41d4183afde0f55d1d9c593af3fae09c26455c4e30f738b8630c72996ca293410a14928eb0ccfa9176263336f8f469e09b97eb14262ba1bdd3c65c9803b6ea6ffe18147ed8be3a45dca32c3ff652ea7e8668b6350eaa49fe27157a40b81fbff4c93a3575c7a5cd19f5fc2ef6344e3891be712db95755fc45fb12192dedd6091047105d0868f8d9ee71e8fe46eff2de001b8408a61de7f6fabdc63adbc0b1cc1e0717e9b18e07b4ed72694629e4455b5c4d7de568df3a50a592682e1c86aa97d297cace9b2e6acd3cc1eb4c52ebccb2ebe8764a6beb4c481725fbdec11fd9a3be7b15234f2babebb3155df1bd32f55dfb6e38bc1f1a94a115ea25b03bf3a40d33fff988383d45485ea30005527d38f6fef10981e51e3e84d0dadb3d1b379491642094f033393c5be17f525540fe0776b8b7762a0b4316589d7f718881d6de11250db759c8e6b332da3816535bd1b493afe92f0acd5062616290840bb1e171f6dd772b19a7a0dccc9297163fb9c6fc9217d71abc85c123eaa21343e4801fad17fc1a768321e6d8e10591aec506ffd2096c8dc2ecc6bf376e821ef4b7a775ac85dd4f4301e39f2acc537fbd27be5d35d2ebb1b0e287dfd34a6eaebd6fbf88379994ee11b6f8f9b18c047128f2ec0b19de4431875441aa6a498b1790a9351f38f25dc73aa8364acad104d1a811a6101b2b76468fea531adee130dac1e968a7654384c5dd36b95e2a2693aeb46c92ca03ba74380ecc25d2cd8acd6af61960cfa90428130ca4a9ad9768915a427f208bf366b10b6fa35ef930b57a353df11d799b3eb337f6d6a08ac62cf640d7f97ebf99f826645febc8325bab07535fee6f39bbc1e584015a08be55cf8f0ee9bf0fbcd20e2d12c3795a9ee9953faf19bf9c5c6a3d9c3c79996d52bbb560c8468add74799db394058aa95d9886c4dbfe46d8bdea3207749241b584f97d3b253b24be0a602b0c460588009de918f378e9fddfce1d3a9c15f726aa2d9ced405adda3a40dc0d948160bdb0e4ef60787169a56e0b2142a25548e9fbd3a8448cb7415e79937fd491de1cfe0c62e31c59edb0c73d257ec29328e2041685acfbc63aa20fbcdbe02b190f2bb4615f3becfb90bdcd0f34d51e6423f0699ea80900a5ca8b748f52d7284ec9e6d688fe5f5be8e9d29139efa3fa1d1c62eaecf0ad4e3cad826eb241"}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:24 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x52540000, 0x0) 03:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:24 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 610.915468][ T7868] binder: undelivered TRANSACTION_ERROR: 29201 03:37:24 executing program 0: clone(0x80310a001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) fcntl$setownex(r2, 0xf, &(0x7f00000000c0)={0x1, r0}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000140)={0x8001009, 0x7, 0x2}) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:24 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x60540000, 0x0) [ 611.210059][T22285] binder: 22222:22285 got transaction to invalid handle [ 611.210081][T22285] binder: 22222:22285 transaction failed 29201/-22, size 0-0 line 2994 03:37:25 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = syz_open_pts(0xffffffffffffffff, 0x200000) ioctl$TCFLSH(r1, 0x540b, 0x9) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r0) read(r0, &(0x7f00000000c0)=""/126, 0x7e) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x4}) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, 0xffffffffffffffff, 0x0) 03:37:25 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x1000, 0x101000) ioctl$VIDIOC_SUBDEV_S_EDID(r0, 0xc0285629, &(0x7f00000001c0)={0x0, 0x7, 0x7, [], &(0x7f0000000180)=0x7}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:25 executing program 0: futex(&(0x7f0000000200)=0x2, 0x5, 0x0, &(0x7f0000000240)={0x77359400}, &(0x7f0000000280)=0x1, 0x1) r0 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x3, 0x2) ioctl$KDDELIO(r0, 0x4b35, 0x0) clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) inotify_init() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1b) ioctl$VIDIOC_G_SELECTION(r0, 0xc040565e, &(0x7f00000002c0)={0x2, 0x102, 0x4, {0x1e5, 0xffffffffffffffd3, 0x40, 0x3}}) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f00000001c0)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) setsockopt$inet6_tcp_int(r2, 0x6, 0x1c, &(0x7f0000000140)=0xffffffffffff0000, 0x4) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r1, 0x0, 0x0) 03:37:25 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x775804c0, 0x0) 03:37:25 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:25 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x6, 0x200000) ioctl$PPPIOCSNPMODE(r1, 0x4008744b, &(0x7f00000000c0)={0xc229, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1a4, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'veth1_to_hsr\x00', 0x201}) 03:37:25 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:25 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x785804c0, 0x0) [ 611.845627][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:25 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xc0045877, 0x0) 03:37:25 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x3, 0x101000) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000100)='\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="880000007d0100000058000200800a0000910100000004000000000000000000800004000000000000c267ffffffffffff10004076626f786e6574316d643573756d5d00000d002f6465762f62696e64657223000800266e6f646576405d1b7c006e6f646576286c6f2d747275737465642f5b2d2b2775736572292400", @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r4], 0x88) 03:37:25 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xc0045878, 0x0) [ 612.119580][T22638] binder: 22526:22638 got transaction to invalid handle [ 612.145653][T22638] binder: 22526:22638 transaction failed 29201/-22, size 0-0 line 2994 03:37:26 executing program 2: r0 = userfaultfd(0xfffffffffffffffc) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) r3 = request_key(&(0x7f0000000240)='cifs.idmap\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000300)={r3, 0x4, 0x8}, &(0x7f0000000340)={'enc=', 'raw', ' hash=', {'sha3-512\x00'}}, &(0x7f00000003c0)="cba7219a4cbfbe14dd0e017a7e818e098170aad5d861069a", &(0x7f0000000400)=""/201) capset(&(0x7f0000000040)={0x20071026, r2}, &(0x7f0000000080)={0x3d1ecac5, 0x0, 0x4, 0x647e, 0xffff, 0x401}) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:26 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 612.765952][ T7855] binder: undelivered TRANSACTION_ERROR: 29201 03:37:28 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xc0189436, 0x0) 03:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$radio(&(0x7f00000001c0)='/dev/radio#\x00', 0x2, 0x2) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r1, 0x118, 0x1, &(0x7f00000000c0)=0x8, 0x4) syz_open_dev$binder(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$KVM_GET_MP_STATE(r1, 0x8004ae98, &(0x7f0000000100)) 03:37:28 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:28 executing program 0: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) r2 = inotify_init() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x10}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000140)={@multicast2, @remote, 0x0}, &(0x7f0000000180)=0xc) ioctl$sock_inet6_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f00000001c0)={@mcast2, 0x71, r4}) fcntl$getown(r2, 0x9) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getgroups(0x2, &(0x7f0000000080)=[0x0, 0xee00]) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:28 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2000, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000040)) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) 03:37:28 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xffffffff}]}) r0 = shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) shmdt(r0) 03:37:28 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xc020660b, 0x0) 03:37:28 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f00000000c0)=@alg, &(0x7f0000000180)=0x80, 0x80800) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0), 0x10) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x4000, 0x0) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000200)={0x200, 0xffffffff, 0x2, 0xfffffffffffff800, 0xf1d, 0x9, 0x8, 0x1}, &(0x7f0000000240)={0x7, 0x9, 0x10000, 0x5, 0x81, 0x5, 0x3, 0x20}, &(0x7f0000000280)={0xffffffff7fffffff, 0x6, 0xc45, 0x0, 0x0, 0x7f, 0x101, 0x4}, &(0x7f0000000300)={r3, r4+10000000}, 0x0) ioctl$TCSBRK(r2, 0x5409, 0xaf55) [ 614.875014][T22787] binder: 22666:22787 got transaction to invalid handle 03:37:28 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 614.931709][T22787] binder: 22666:22787 transaction failed 29201/-22, size 0-0 line 2994 03:37:28 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xfeffffff, 0x0) 03:37:28 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r0) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000040), 0x0) dup3(r0, r1, 0x0) 03:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x2) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000180)={0x8}, 0x4) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="db000000c8a45b1f8476ba971e7ce5ba4c0b45461b7d560c9c00c84853cfaba18cbfff020d62c06ca208878fcd5eef90364d52b6d15f2d242d8e54426c4d5b01dbefb6e6ca44e55207914228c66743e75f1f6c268ea95b3fed6b0409af85bf994fc560597fb2993462eeec9cf95ff82c7f1de664bb3bca9bff82329e3030cd1b9d3b6f86f259f5ea8f37d5ee0078ffb25e56c36adbbddc9af30f8cfdb598ceb17cf0fdf744c96d54727a77c5c23c020000008a7a693834bb9a5857990e7c94c79fcd7c3f625ef5721cd39f357c75b78a24a97045455ff83d10b934dc8f574d0f7aa98650bdad049fc28d5a065dfa6628d47311e2577ae516324fa9647c0bf25cf37aff74fa99b78b04dd0856253e7bdd8f2a52aa74dfd4acb5496e1c81a70e08ec289c"], &(0x7f00000000c0)=0xe3) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r2, 0x4) syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x39a, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='\x00'}) 03:37:28 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xff600000, 0x0) [ 615.140892][ T26] audit: type=1326 audit(2000000248.649:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22795 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:28 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xd931010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:29 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xfffffffe, 0x0) 03:37:29 executing program 5: syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = semget(0x0, 0x4, 0x300) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000240)=""/107) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x80000) ioctl$sock_netdev_private(r1, 0x89fd, &(0x7f0000000180)="730b49926c5ff17b38be45819cd6940b69d97493f115a4deaccdcf0384a62310dc4f914f7566594bf5acbcbecf1fb3b6e4c0a21e6101a0c55f81fbdf93a98243f0c22a20cdeec49e8b30ddd5f62bc38e277f5864396a23221b497cee5059bede1eb821eb857f4667fc8144cdfeab3f9a264e24c90097de0907831a173724870773a1810116ecb6c6bc6f2bb033f51967506a3b72") r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 615.513007][ T7868] binder: undelivered TRANSACTION_ERROR: 29201 [ 615.678170][T23135] binder: 23032:23135 got transaction to invalid handle [ 615.685201][T23135] binder: 23032:23135 transaction failed 29201/-22, size 0-0 line 2994 [ 615.731225][ T26] audit: type=1326 audit(2000000249.239:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22795 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:29 executing program 0: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x1, 0x0) write$binfmt_elf64(r0, &(0x7f00000017c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) 03:37:29 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xda31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:29 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x400000000000, 0x0) 03:37:29 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/loop-control\x00', 0x200000, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) r1 = creat(&(0x7f0000000300)='./file0\x00', 0x61) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000480)=0x14) recvfrom$packet(r1, &(0x7f0000000340)=""/208, 0xd0, 0x0, &(0x7f00000004c0)={0x11, 0xf6, r2, 0x1, 0x5f0056dc, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) fstat(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000100), &(0x7f0000000180)=0x0, &(0x7f00000001c0)) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r1, 0xc034564b, &(0x7f0000000500)={0x6, 0x77717777, 0x1000, 0xffff, 0x2, @discrete={0x9, 0x7f}}) setreuid(r4, r5) r6 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vsock\x00', 0x0, 0x0) signalfd(r1, &(0x7f0000000540)={0x401}, 0x8) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r6, 0x6, 0x15, &(0x7f00000002c0)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$UI_END_FF_ERASE(r6, 0x400c55cb, &(0x7f0000000040)={0xf, 0xffff, 0x9}) 03:37:29 executing program 0: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_proto_private(r0, 0x890b, &(0x7f0000000040)) 03:37:29 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x88}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x200, 0x2) epoll_create(0x87) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) sendmmsg$nfc_llcp(r1, &(0x7f0000001780)=[{&(0x7f0000000240)={0x27, 0x1, 0x2, 0x4, 0xd45, 0x80, "4b6a7a0af25b0ca66c4d2e2ef530c446082b30e64c5a21b0f2174aac48aeccef5ebe950f1cc2b9bf839c9f753d0160dc3edb4d1c57bcf4377cfaa66bb6edb5", 0x12}, 0x60, &(0x7f0000001500)=[{&(0x7f0000000140)="8b5f5c03461867db4077db9ac66af65fb30797cfecc4d307319da395fad33c732d91abcfd9a1e192b7af994c42df6bdc", 0x30}, {&(0x7f00000002c0)="972d0e219b69051a3ddfa1fd81f2759c1c3e877a4277d0301876f85a7bb96f8ded22d27dc9943e64e10716524a7f2d134d54ea7fdc47015986aad8e5a086aefc4f91cffbc72773a2087cd14b1707480588f4f96ae11e9350f481c5c53baad84750385f82338a3f75af8927d320eb16e272f80d25bfbf4a84b147c17d22889b34fec53546f8fe05792c61139d2395e09d7c35b2f75a54d5680208b504a0e6348315624fb48df4959f1c1cfa17b8bb9598aabc1ce4bd7aa20abbaa1f659a7611f389902397559e4b3dc21872255a9f3e399d", 0xd1}, {&(0x7f00000003c0)="9c3dd570147fb7c24555ac4471cb05818106de9502eadb4901861b45e24412f2df31d96fc3483cecc7231f6c1247f7a10152c83c407f2356e630fd368174b430f85cf2170456ab481f1b3f355b301b967cbcf551be21f769055091d09387bd9747a381aa94fc4e273e20573492265343be0c4450489207f827f205f181cef0484c69b8b58d4031e78876da1255dce81be0ee1712dadb7035a8c0d95d4511bb848411b42e568823daa7adbac21d5dce1e188a357f9da70dbdadad61b2421167e18e5c528624f8a3dbc215c98ef97c5fc604eea701d2ecd37f56db44d2e3bf50f2d40fa2bb5cd100decf55bbb4c8bc33205fedf98629fc5204d9b338dc44c8271c68be5cb8e44bd6690b9a837b8507cbc1e1f74a7bdd62aee6b7751af34d9dfbeccedc288f871a358791b0530aa4a0d9210ea1ea98f25fe7b12ac983fbabee9413f8be46ffb93a258f0dd4e516ff34c132a44ae22b51f9c7dbd37e78427b7498f6d6f49790172917571d0ce861bc585bc5c9e44717a46838c154cfcb270e3308e6fa6da6919328fde403a0c39c1f90f08bb15184f5952e3eb2dafd13f651dd572a92b01e2f89d336ebee184ec77f188f8419c37696366cdb6d5ad4c1081708ddab651ae4bb2a758cad445ca9b043110c2e0902ff5b03f644bae20b1b5283f2e640e4983e9c8298b10f292e23950a4342847c1384514483a520cae5372eacd6e2f3dfa971abcdea7a748c75e737a17a0f201b6e378919f7e8faffeb38ffb138ff2616b75f4c8492674fccecf82f559d5189e1637b44ac8231ee422648fdc7c185979cb1aca64311c581273cbd0d8cce86eab244fb09182b60802f4b0e8268b7245d7079bbf6ab08bb0c3180c3ea0e81f61afdb589997af37318dd3852caa5ce4a3bf6a2530a5fe154ffe5733cde6f06d50a38c3aae610b77fe41400d74410d3c0e8e8a469884c41765dce19336e276d73d4e68801dd50803c3b3c80e8e24f3cb0d6279b6e0b928493198db208542e6b4b9bb8aa6b2d4e316eb3a0494d2b7e335a5897c1b88c9b34decc31bd1e702f6b0ec62ffbab1977f3cd5ad0038b68a7c5c8c6963142dbda675e4cce85a8558c7bf4fa7d15280f52daa82722ee272a48095c9e7d6df55c82bdd3ab10c97a327b10fe0414bdb932395712bd2a11bfdcefa68f2698831fd816ac610043feda11bafae1e4859637d5a395159e35601802d6b3ebefa80ffcdf54ef956b1bb2c7938933790655baf4995959ee73814b7310880a6dc4f6264411b3af7a04c83143f76a7ff059dde03b456a47927ec9696fe7cc0319cec87fc3632136468cb8f917d679d2066533cacfba82131c4adc465cafe3bf644ac87e18190767d8594724e1a53aaa0179bb6fb21373ca46e8e859da1787365146095e3bfe554b16715463e66cbc6ebf0baa1cb74ebadae7b9ca44b36f4e8696a0774e2a34ecaddfbc721eca0b81364ae1890cc87847b5d4b8208f8dc05d69265a1562d15385df88ec84cb9e6b3b553765a07cc9f853c678b5b72b1bfd256151e29d53593bcaeb673bec4da6c91f312a0c3a1dd4635bbbcc2be67b2c87e89ceec18ef64105c01d0aa2141c97ba7ce5d3075ddf9916d73dea945753b178cb89598fbdb507792bc0a9bb607a7bc9aeda934f28726af093e59dbd2b112e0ab8ef168c0b8a867e572fc9babb8676fbb652eecc13c388db8e81b776d7c67b7f8e9d2f76dfefc17bc23e1f4eca9f316b30d9da61005118930c7a7fb6929aef877485e6f71c0e7912f4c7ca2b5b2437491d5d418a09b3454bb6d42f2a722ba8f7407d57a8af13a5048f3137b5d3fdb2dbdcc25a7d29792c7ab529e81b3d5b001a47320d727cf7185bfddbce626b29e3bb2ba805df04808f1f84f3922836d2f71d9f95aecf275908642d3292a972d59c4a69332880de486cd02f9845373f78b64d8fe7f8c13e7cf8afcbb9089bb08fd0b802dc976cd7b70694df68452c913b46e0c3d8835175533b1bd4abe8fa5dd1862d88c98d6e4c77e840d03d7ed3cd1f576b6f3d002cd2474a819cf4e6e1bb0523e9059ad39b22435f29146dcefe1bd3884caea24196dc10a3ddca23edd2289e5a05b307a48531d4881ad5b1b2a19a3eafb9759e9ed1884462cc43877e48e7d691590664dfc3d75854e45a86469394ca0c044d372c0909cc166682fc61e8248a0221c946e28a727fcd2717ac7b14fc30ad969b400c23fb429233e18d8330401f013bc549acc8e12f0a8b2643c3b7bc45406bf27cee0e3e3f7fe46b9b65e68c1d3eb38b5ea158ebdfa7c33f14eb5ded2644ebd1ffd49fcf087c597e0e55b8560a833884d9c981ce06f54064a072282a3d4f2d222836accea80a8b736855c9f82fa78235fa3e24cd3e4c8fe24c60a02679ceab8edaac2ac2a6b2b32b38796a2174e9769d9a493a4aa7aba63c691fcc5ce88d0b86f35c6192644820471e10e31bb38d043282a99f7675277b1ab5b84426da17258e0d97623a384db4db7e6d131b16075d9309edc643f335f6b1e144aa5a16e049491df0ea4d5ed6ac142341011a0bc5c3573b0340cd92a8a5e7397338afa00a90bff9bdc27a34fb906637fa46b32d9bdd6f75a20d7413d59fae614316ca2fa675c0ab40c8d75b41fe53f16f1fdbf38e5ec93307f8c1838b35b99bc6d81235157f31e307516b90e437f477c9bf5aa00121ad2c7cfd19fb833183672a92145724cb6a924b4679e662f21c3202de520ef97ad528083b2d5dc78f7f06918b9bf04c4618e3ca667ed6a379c175f6d375c3c337deb75a8b722f77e24b716fb9e2d8c2785e955b88b7435676604404d05c2da18fe81d5f331899f928888c4ba11e629350ddb6d31ff3b291fb2603af1616ac079fef1c7be3d922791ef259523b337281779b9335c00e8e74d2eb97c200b07d00e6e41db9132ead88eb1ae3225cd4a257746699d2e050716f73c9d40c9bd709a6be98647fee96024ed14218d8948463e6107c0d462a51d7df19272daa2bec5b89addaa06f18202b3f9b859a8503eae8f8dc95f63c10c5d8e90e321a83ea631457dec6136e79d138b8fbe3708bc5ef07369d61ba4f7740ab2f65bf07976bb21592ea14165a2d7584718836e0e9be23937aebf7c436467aac42332ae5ed1ea9daa4d8a5ba3bb6462699e28dadd2e3fabaae9437b3572a93ef88f5f0a12ac6c3661046512817298fac84ba16d36d2f0dab5ac3b81fca2edb23256d91de5544d1c6e5c94b1cdaa15d3f41744887a3d68fe55896799c463e8a8cd5a5566cc474af1ce91e12e5ce8067b935b03b0a641fe83d8986da407f4c7876cecf0a2ac63d0f62a78af71039485677ed8a2881193275ee2f35cb2fc6b927e3b62a4faf2bf3aa8cc1791a69d48a1d87ce91fa6cd70442cda5d3cbcb8abd77f7d854bfc69b9f0eafac501799360aa36d7dd047a553328b6da517d884d5e8adcdc91e32ddb63ef38be5a61204c7c48b154bddc6031e629a598b539555df3188b783c57aa5ffc5b2b2f1431ffebcf8c906e1fbcef0beff53be59d5bbac0ca7472a5d8e59576c2d84fcdb5bc1b3b0702517200c5c1a343f1de8317bd99d6e9110f19fa0ed19b1bf3e062530ebc05af78ba3b2a573226af1341d0cfdac1583597700b802e93e5b1899531d364dd427b96d016e2116c625a64c719548b46e6d85c3be2f95f540dac04d89cc72a4397398e5719e575b55cce59fa2b28540cb2f2cfae772138dd8982fdf7c8e1f514713a0dca001a983a2ea5f662c045c0c4f2ae2199159b928bd6c878142b38af085deb86bffe2f237e1237041662412eae979867b13e047a553402b3c312b3e7b57726cebfc9e0b360b723ba2d99c61b4592e199b6a2e730a712e0abe240665f3056eff5dc853095fffa9e9aeab8e863a5c0f81d1b214131652db2114aa9d20e92a26dddfff2640fee51d5c35bb993d16102bf01c547ce014f485e654afd2469133cae416827ad580d7d8d452b8f21cf52206d5a4cdd6dc8a604013cbd8f6b1b7e8ccca7f11e346afbc2255d347e854eaa5ffbba8f6f75ec2418ce80d5db8e770cc98fc31477946686270e86ca84d84926f684fbb0ade3035b19a9eab846cfda11b6d8c6c3b5cba9b30ae2814371208bb97859d2cb245571547169a7b4f4b1642dbd0919b4e4295c38ddd55c40bc88dca6fd1562f39ceed1dfe1e32d3e9f11c222332cffd689d09c9be86b61a6b66f76d42119a4fa126eeba62ff1cc86352b6cb88e34ca069fc29dfe17570d864f7d2307ec3e5f7351c12cffb9eb8995afba61f7066b2ef4f835cb86a85668fb9c176a4be12d3aaa81e591db52410e81a61ac42ddd4b606683243e33257203fe003689c7065539b9947f47b809d8b8743fc121bb11bd0db85c9a5cd496094d225aeb15ec48f13f5dc9f3d9d1ce9a652afa3a9079a1524d2c9025479f680a9d03fd89184df5da8eed0e8665f1922aeef91d83944ec67f3f36daf51529fa2cebbb88218132574e48d253e46f8f748477b316e60dde351f29f9bd45c1d3aee630b1098ff84af60934fcbe337d69e4e2adf907e6dc73e08b7c7ce902a42e9e3bed5856e31e852502db7707c2ae161ee6633a98bb73e81e2ee3b504aaa90a5c16549ccc05f06f56bfcdefa2225e64c68f7b38ceee8570f372ee4d92754f3f36be01fbe6de59099f6e2c5d09628aff995c197bbf83cce172afdd049b355648ff1c6ea847c150571f6702135db3cb4123d15454646f66d0a70c21beea2a6f325694b3616ca366f2a33ec82f098e0f7a86a743e6f4597dc84a16f131b1c9e22ba791e61ebecb9b9328b32794ea91748feddd559a2866ac54fc3732a68a6683e38ee7567e2aece5b4bc10bc1ca4a3ab293b36da7b16a3a01e0eff3f6716bee021a4d1b8f64855805dc9ef9e896fa969da922fcc0c4f708cb1cac91dbc8124c9a4687bad22c1510dc2f8ec3c2a6fec6dcdd878f434183104d55dfbc69132a185a8f89029d46b1464fc31e0fa181a85ff2a63f3db594e2023ad687074a2090e6b2c3a12d027c19b95729656668b3c6445212253fc910da9009c269f44a63d95fe736afb02dfdb2657ee0b17a9ff7376eb763acb92a3d3a489ee9bd97d91d5ebb1e2983157a3c18767430ef67f8380072a292de03a632bdeaa7d5dc223b064c514a7c0efa2effe6e956ee584c1731743a5446cb6139c3982f968ee9929aac928d49a01f1cb55c0a22da2aa35e0d715c22e8dbc376b964f4c980761b9d908a6f1783122785925563c8fe90f3e4d096ae090aebc19fca320d8df31b0171c2ebea738d1d53f33b99567ce729c59b62c32f7165bdf5764cab655afc4423813072f751657eac4347c55a9735c13a6de2a759230fa3d705340ca68f29a0b6bdaa75dec69ae0094b4e4d9367b29b6ad7d22e58678501ee80be81e9e1f860e12d35f9de092e35d1fac43842c3e25aef2064c68dbac1d59ce359b8b5f1e761ceedcbeaa1c71479c9f586ea9c403e09e69c92fc424507862037a168257086ac5fd441208cf4650e72fdc113184d839eb8a2f2d12efc4ae03ea5b5263cb40080ec2896cb86d8ca460db5e5b6d99ea08dfe0ac876e846a086b66462fb53782c4bedbe4db01850485227f98c839b64f4b3639e8e296b66bfee8766f5d8ec3f4ca0000700ed35d1c4830a238bb7ecc7c07f4e7bc06c0233726af2ac96c1031bccab9cef03092c6ea954325d59fa79c1a5be4fe44b7bacaae418ec53f5b1005b7725b530de4d955c3e5cbf6669ba65ac6cc89a9e54a40c7b6fbcddca1046565f835f2c459fe47af3ae0cbbc0add391c6118623a3", 0x1000}, {&(0x7f00000013c0)="bae7b6c4143c48488f18c11658348fdfe84a4ad83a290bff05b40570706e734a936e54b77e8a68edd716c51031bc22e2f509a8b423b3bb227d9aec12c7870864de068b4d3c0e9ca32110ec920206cb311633fa906ba3688cbb94b2fb8b1fcd3a3e3b77ff37f21ffe77875e25d82827310670239c30a17a72c8a91bb2e6f64e23bae22655cd2b496e4239d1d59ea4da7ab5e3cde8b665dbc1422ea4ed1839742789188fe443e623e78355a912e82752f94bd39186a809a1e3de466f0aaa6160", 0xbf}, {&(0x7f0000001480)="6dcaebc14ec4f937c05cdf6fbb9230bd0c9d7fa95979feec6b0a86c78d569f47fffc8a99764758c76d395c8a3e189999c3b0186366c33e8848fa8f09cf56e0b0a383086c122d8d0a3408", 0x4a}], 0x5, &(0x7f0000001580)=ANY=[@ANYBLOB="680000000000000000000000e2a400002ff8008eb3ee8c21500c46cf9a29a66bc31ae55c39e47477a005cc1dcf9f73819ce35f158a68f6f72972a49c9d1add7b1947c066129313d8861174505f867b000df7c99486f2eccfddea245859731c639fc6000000000000"], 0x68, 0x800}, {&(0x7f0000001600)={0x27, 0x1, 0x0, 0x7, 0x8, 0x0, "89c8552316e14497f1e0f174c870d2d7c49621729edca28fc2c31acd83e3bf4df2d02645caf9bfc1871054b3da5f109899d289f6e9a45c191029342e575a7a", 0x1c}, 0x60, &(0x7f0000001740)=[{&(0x7f0000001680)="ea09da21511f447292579698c69fec720a73fc5f1b2351228741853e07d816e9f9c88c718a048c6f46da66828fe92538fd99363e0034e301dd02e5d3d34c591954cfc376693d25e7efbcdaf256a406830e4695eaf14b4b88b9c7ac7b06f1", 0x5e}, {&(0x7f00000001c0)="bff1c8a9a15142b04b237d53fe9fc73cc8da083875b2b8", 0x17}, {&(0x7f0000001700)="63aea1001fed7b7f20f949d8ecc259bde0774892594187a87cd03dc40a06f5235e0e798cd30e3ac05403a36f83f7ee0f677702919f", 0x35}], 0x3, 0x0, 0x0, 0x20000800}], 0x2, 0x4855) read(r0, &(0x7f00000000c0)=""/126, 0x7e) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2000, 0x0) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r2, 0x0) 03:37:29 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x60ffffffffff, 0x0) 03:37:29 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f00000000c0)={0x2, 0x544, 0xffffffff, 0x74c3, 0x2, 0x8713}) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000180)=""/4096) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:29 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdb31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:37:29 executing program 0: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RFSYNC(0xffffffffffffffff, &(0x7f0000000080)={0x7, 0x33, 0x2}, 0x7) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000580)) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) r3 = perf_event_open(&(0x7f0000c86f88)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0) read(r3, &(0x7f0000000140)=""/117, 0x75) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000bc0)={@initdev, @local}, &(0x7f0000000c00)=0xc) accept4$vsock_stream(0xffffffffffffff9c, &(0x7f00000031c0)={0x28, 0x0, 0xffffffff, @host}, 0x10, 0x80800) syz_open_dev$sndpcmc(0x0, 0x6, 0x4000) 03:37:29 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x740000000000, 0x0) 03:37:29 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x200400, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r0, &(0x7f00000000c0)="779104eebf3aa5", &(0x7f0000000180)=""/210}, 0x18) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:29 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdc31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 616.363240][ T7868] binder: undelivered TRANSACTION_ERROR: 29201 03:37:30 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x7fffffffefff, 0x0) 03:37:30 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xfffffffffffffed0, 0x0, &(0x7f0000000180)="a6464ba455f66d56a737b042c87e5ba987edfe279529749db4edfdce1a0cf4973c628c5660fed32a2e47f0e1e65bbf86fed192ef250d37ad8a8519e864490d8249c74eca89947ac5b3b7dae8517a43eb895cb05bfd40ed05f16a1f80816824a1ea2d4bc87c545d72a8bc8a02df70b1874306b20498e43dbc2241ce7172e50590b36ac8290baa4f4f255b77d6fcbb4d3fdcb5f11d81ae32ef05f3a67cfd9fd80c7432d1e02dcc17784ad4354c8b7228068bcba8bdbc9bdeafc09a0ed7036b79e9eb8d28283b5499c50d452cef6b17a5241aad6cc02a7c177941e078848373862d50c62b60d9b49deac3ba0d136b49a6467e28"}) 03:37:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdd31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 616.594434][T23498] binder_alloc: 23396: binder_alloc_buf, no vma [ 616.605736][T23498] binder: 23396:23498 transaction failed 29189/-3, size 0-0 line 3147 03:37:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x4, &(0x7f0000000000)="3749901709bd6eba97641624c22ce5", 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x200000, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) dup3(r0, r1, 0x0) 03:37:30 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x940000000000, 0x0) 03:37:30 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:30 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00\x84\xe0\xda\x82a\xbe\x18O\x17\x1b\\\x143\x06v\x9b=>\xc1\xd9\x06\x00\x05\xf7\xae\xce\xbeA,j5\xac\xf5\xf0&\xc5$\x951QC\x87\x9f\xe0};\xac\xb7k>0\xce\xcd~\xd766*\fo=Cg&[\x8b\xe2\xbd\xe9\x16\xc6\x1e\x97e]\xb0\xed\xe7I\x18\x96RS\x10\x8cyr\xb7\xcf', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x7c774aac) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x800003, 0x8012, r0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:37:30 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xde00000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:30 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x1000000000000, 0x0) 03:37:30 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x12, 0x1000, 0x5, 0xa41, 0x1, r0, 0x8}, 0x2c) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) write$P9_RLCREATE(r0, &(0x7f0000000100)={0x18, 0xf, 0x1, {{0xa, 0x2, 0x7}, 0x6}}, 0x18) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x800) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20080, 0x0) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f0000000040)) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r0, 0xfffffffffffffffe) [ 617.235520][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:37:30 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x30710000000000, 0x0) 03:37:30 executing program 5: r0 = syz_open_dev$cec(&(0x7f0000000340)='/dev/cec#\x00', 0x0, 0x2) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000380)=0x43a, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x1, 0x101000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xc8, r3, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100000001}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x863d}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3f}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3f}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffff14f}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40000}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x6}}]}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x67b}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3ff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x29}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@rand_addr=0xff54}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x800}, 0x40) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) getsockname$packet(r1, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000440)=0x14) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000480)={{{@in6=@mcast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000580)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@remote, @in6=@dev={0xfe, 0x80, [], 0x12}, 0x4e20, 0x0, 0x4e21, 0x400, 0x0, 0x20, 0x0, 0xaf, r5, r6}, {0x1, 0x800, 0x7, 0x3, 0x9, 0x0, 0x3, 0x3}, {0x200, 0x9, 0x10001, 0x5}, 0xffff, 0x6e6bb9, 0x0, 0x1, 0x1, 0x2}, {{@in=@broadcast, 0x4d6, 0x33}, 0x2, @in6=@mcast2, 0x3503, 0x3, 0x3, 0x3f, 0x81, 0x3ff, 0xfffffffffffffffa}}, 0xe8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BLKRAGET(r0, 0x1263, &(0x7f00000003c0)) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f00000006c0)=r0) 03:37:31 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xa0700000000000, 0x0) [ 617.547918][T23920] binder_alloc: 23786: binder_alloc_buf, no vma [ 617.578466][T23920] binder: 23786:23920 transaction failed 29189/-3, size 0-0 line 3147 03:37:31 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xde31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:31 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000180)={{0xffffffffffffffff, 0x0, 0x2}, 0x5, 0x78, 'id1\x00', 'timer1\x00', 0x0, 0x9, 0x4, 0x6, 0x3}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xffffffffffffffff) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x80002, 0x0) ioctl$RTC_VL_CLR(r2, 0x7014) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r2, 0x40bc5311, &(0x7f0000000280)={0x6, 0x0, 'client1\x00', 0x0, "ed548c1e15f4e28f", "42a14e34f1fc2c866a2da74b4e1a4dc874ab5636a6cade159ef1cff37ecf572f", 0x14, 0x4}) 03:37:31 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xb0500000000000, 0x0) 03:37:31 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100)='cgroup.type\x00', 0x2, 0x0) write$cgroup_type(r1, 0x0, 0x0) 03:37:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r3 = msgget(0x2, 0x420) msgctl$IPC_STAT(r3, 0x2, &(0x7f00000012c0)=""/244) r4 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r5, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r3, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r4, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r6 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r6, 0x301, &(0x7f0000000180)) 03:37:31 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={0xffffffffffffff9c}) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f00000000c0)=0x4, &(0x7f0000000100)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:31 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xdf31010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:31 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x100000000000000, 0x0) [ 618.165516][ T7855] binder: undelivered TRANSACTION_ERROR: 29189 03:37:31 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x62}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffff08a, 0x101000) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000040)=0x1) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r1, 0x40a85321, &(0x7f0000000400)={{0x1, 0x3}, 'port1\x00', 0x60, 0x40, 0x8000, 0xffffffffffffc480, 0x4ba, 0x5, 0x68e, 0x0, 0x2, 0x8}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='mounts\x00') preadv(r3, &(0x7f0000000240)=[{&(0x7f0000000080)=""/120, 0x78}], 0x1, 0x200000e3) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r4 = dup3(r0, r2, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x7, 0x1f, 0x9b6, 0x5, 0xffffffffffff904f}, &(0x7f0000000340)=0x98) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000380)={0x2, 0x2, 0x7, 0x2, r5}, &(0x7f00000003c0)=0x10) 03:37:31 executing program 0: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_proto_private(r0, 0x890b, 0x0) 03:37:31 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r1 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x1, 0x0) getsockopt$inet6_tcp_int(r1, 0x6, 0x8, &(0x7f00000001c0), &(0x7f0000000200)=0x4) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000180)) write$apparmor_current(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="6368616e6765686174203078303030303030303030303030303030305e2f6465762f62696e6465722300002f6465762f62696e64657223002f6465762f62696e64657223002f6465762f62696e64657223002f6465762f62696e64657223000073797374656d27776c616e30009925cafd541a9463ca9a977afddd6e7b0045574c30e37bf1e452534f090b62b9bacf23ce2225bb718d1e46cd02d753e0e9c8a865c64958b912d1a7429b0cec5bceabc7c593d2a6827e09217ee7d702ed"], 0x6d) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 618.329239][T24214] binder_alloc: 24104: binder_alloc_buf, no vma 03:37:31 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x200000000000000, 0x0) 03:37:31 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/uinput\x00', 0x80000000002, 0x0) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0x0) write$uinput_user_dev(r0, &(0x7f0000000bc0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x0, 0x1}, 'syz1\x00'}) [ 618.369887][T24214] binder: 24104:24214 transaction failed 29189/-3, size 0-0 line 3147 03:37:31 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe031010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:32 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffff7fffd, 0x10031, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000001080)={'filter\x00', 0x0, 0x0, 0x0, [], 0x0, 0x0, 0x0}, &(0x7f0000001100)=0x50) 03:37:32 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff9000/0x5000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000e03000/0x3000)=nil, &(0x7f0000c77000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000180)="2c31697ea1d00c82473d8f484d4e75091f7d219786c8e71afebe9c99a12d67c317ef0993f75e2607e9032fc4427eadce8f920b97723bd7b4e7eb519e554055341b7a901ef6136971dfdfa31bb59a1daf81c6a2e88d27dccf2e4448c6d4c600c94e83259fa8d54a5ef2c4785203e295ea9e7b9f5bca3826e67d4789d6af65153c98dad77b986248faeee8438afeb2e79ec7f8ab3e3983026a29762cb8cf75e54c6c49fdfe3b68f331f158af0293c9a339a228653c2fb7ccfb08f9d7e9cb66aaa11a962372", 0xc4, r0}, 0x68) 03:37:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:32 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'bridge_slave_0\x00\x04'}) r1 = socket$inet6(0xa, 0x803, 0x3) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@rand_addr="46c47c1ed4a15ba5634a38620c96604b", 0x0, r2}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'bridge_slave_0\x00?', 0x22000000c0ffffff}) 03:37:32 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x994044000000000, 0x0) 03:37:32 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe131010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 619.024150][ T7868] binder: undelivered TRANSACTION_ERROR: 29189 [ 619.115391][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 619.121277][ C1] protocol 88fb is buggy, dev hsr_slave_1 03:37:32 executing program 2: r0 = userfaultfd(0x0) sendmsg$nl_generic(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x880}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x1d, 0x410, 0x70bd29, 0x25dfdbfd, {0x12}, [@typed={0x8, 0x4e, @fd=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x48000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f0000000480)="f93069bdc83b5aa0a14b8fe0384d85d2efba2be1547a4698fd51963e44835566aa231d451bbdf4c0739212ae7abfdc3dd9d59c940926e1fb8f0e45782120ec4a0ffe07484c0d5d81c3628a5474012df2668bebd29ae4a106d6cd6e56065c22c0dd03e8112511cd448f2ec1384a5797c6b8a6e4aae64f26a60fa1d4f4209a93cb8c09311b147af087a63ce0b1f3d278df4bbfa6064db5a7ad41d7235f076a54f626fb27bc8700b6964f0940c6ee38ee191889a9d9eff9c3fb4917541bbdc90a0fdff558c6f436d11b73c0dc1500a86704d0e1389bcdec7363db5ae3f640b003c7c7586e7127f80d7d1b22557f0450629e3ffc6e558f52d28eef6c9f0185e9c8dbb901850e85ed63dfbd25047cd67a2a518fc598216f25ec1c29299c77a701950a6ae117ab3d36848a9786620ccfd498aea7a990e95c948f788ec34acb70537c29237556a64ab358948c30d4b7ba009454cb005bfe2cfd94dd5f82a2dc9090fa2b80d3be5fcc8a1d82656b35779623d1e893ad157d3482cc51b59ba8d23de6c2d5f3ef2971d98b7e52b63b807399b11e889a5e9087fae09480a25e67160e1e51ab64e1a5d3457420e2cc7c7bee06bdb86e763c168634b7dc8831c5dc0828ff928e161838fdd8af478c93435a3d31eb3da7085a89cbf50e1b5d62c24b3b", 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x373, 0x0, &(0x7f0000000000)='\x00'}) 03:37:32 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xb6620c000000000, 0x0) [ 619.190457][T24463] binder: 24455:24463 got transaction to invalid handle [ 619.205307][T24463] binder: 24455:24463 transaction failed 29201/-22, size 0-0 line 2994 [ 619.215672][T24452] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.275325][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 619.281191][ C1] protocol 88fb is buggy, dev hsr_slave_1 03:37:32 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xd94204000000000, 0x0) 03:37:32 executing program 5: r0 = dup(0xffffffffffffff9c) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000300), &(0x7f0000000280)=0xfffffffffffffe8b) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)=""/18, 0x12) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') syncfs(r0) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10040000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, r1, 0x4, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xbe60000000000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 619.354124][T24459] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.361336][T24459] bridge0: port 1(bridge_slave_0) entered forwarding state [ 619.368938][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 619.374728][ C0] protocol 88fb is buggy, dev hsr_slave_1 03:37:33 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe231010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:33 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x1b54000000000000, 0x0) 03:37:33 executing program 5: r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x955, 0x40) sendmsg$kcm(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)="cfce87baa6074e976aef5bc574429240836394bce612c6847afe385596ded65581ca50238e3bb465fe259ef8059f72be91ef1d5834f11b18de0e2fdd28c4e6967d5ab0edc56f1c7e02a8155287a753830c5702aa3e84e529b7d52d1f494ecdc292458c642f828c8118938bc313b58088cf84da16e1584563", 0x78}, {&(0x7f0000000180)="b6ff1b3a20a9", 0x6}, {&(0x7f00000001c0)="a703eb3f4829c438e2373cd124f371c1fe47b3939aa9ed4aec439c242689632ad4bb69a9f69dc5cf19e00881b25ab1d3f749df958b101951adae5fdba7afdc752e068ef4270bc1965ef1bc6d7243252539034b9cfed831d8a2f74a862be316b5d905dd14d162e2426ce3b766b0bced2c86e147141a52b0250db8cb40f4908bdd89b7c0a8694e8802b9cf13e348fd13d0807b", 0x92}], 0x3, &(0x7f00000002c0)=[{0x10, 0x10f, 0x3f}, {0x28, 0x105, 0x1ffc0000000000, "dafa3da1c9a196ff76749d01bbb980d761e3"}, {0xf8, 0x109, 0x401, "01a7d0dca595e401cb6ff21350c20f47b4fdafb2add14e896259fe925c78069abe9b3e644dfae93622322aaf358cee2275453ddb4da7e20489eb9710e1c775c6ad7154c52008c0c753c25d8ba19d9a2e0d86da3c9456574124ad06e149040e1c1db81264384bb27f4ee2ae8cf5d006c2d65ff8223f4dbdac5f39efcc01d9cf52310c5b483d63a86a88461e2048169e5b972e8f18b3cfd2ff6eee986d30503c7120de23508b6826705f90c067ccd2ac21b31a889727dba72bfb0382bdb4dcde33dfda76441d08d5aceddd16f3f63f265849d19c74eeb4b68f912fc9736dc54012ef258beb6b76edc7"}, {0xf8, 0x117, 0x7, "9de1b824d8ff3685c22d4b20b266f3edd9866eed71c4167748c721da17b7896177e4f42c4ff126356655e20393ab49ba95c47355c8879bae957132cd88650fbfcda00260e85cc02b2f4ea84a7f11929e71cd68bfc012b8c8bfd4c85ef3205d5e19343c87c3706814e533f421a685103118c179800e1752cd4f3017c6a161aa1c41e7c4cdcb13daa5c2417659d646b076d97b85b1d67e65efeee73bf9799cf99f034c28a3f0934d7e015885e8c34f09ef8e5f66626ca95c3885b0cc7563fb8409f80cf5121c0e255fda48d5545f7c65ee7fe10771333b1554306c14b886e2bb50a44aacfcfdb7"}, {0x50, 0x10b, 0xbdcf, "50b468c3076c6bb74c6cf506da64f0488abe2a8de859ce0ba50ea9ed436c7e28cc3f2bb05b927af98c1442f1d17691471657bf4d183117db04"}, {0x78, 0x10c, 0x26, "a79a836dbfa309d355ca7fb9cfc4e001745ff6882f0a8777e9b90a41cb027f5b369fcc506303ffe9f381a4716b76661993e3211cb05f9bf13a04af183e5232627c65a8433cd6a435c2deea0f02e26716e529c736b2853ca00f6a3cd1fbeffe3d89da4e30"}, {0xc8, 0x13f, 0x40, "5d01a7eaf1bec00b0ceff6b3f1d9209ef3b3f54a294683e4b6a88719af3d8189bee9931c0de84143bf7460febcb155ab4f972abf74872ecc9eb3d16c2ae156093c67e9923e038e08f3168443d6d0bc8b830e44c72b86aaa54a38bfa2003038bca7296c4b195665cd16b8e94febf5b52c7b2d592931856a482654c842ae6e106f582c6befb835ef7e66f40435d6400f713e334ef4b13f4897aa42d5bdd2d81460c47fafc895bec0406d817b6acdecc89f54752f216d"}, {0x18, 0xbe88742efaa28603, 0x20, "caf7"}], 0x3d0}, 0x8000) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 619.695979][T24452] bridge0: port 1(bridge_slave_0) entered disabled state 03:37:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) [ 619.875523][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:33 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'bridge_slave_0\x00\x04'}) r1 = socket$inet6(0xa, 0x803, 0x3) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={@rand_addr="46c47c1ed4a15ba5634a38620c96604b", 0x0, r2}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'bridge_slave_0\x00?', 0x22000000c0ffffff}) 03:37:33 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2154000000000000, 0x0) 03:37:33 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x4, 0x4, 0x3, "16ab565b95bf1794fb6daf6c9db957b0296cd78399b0aa60b9f4592b401e9bf3", 0x31303553}) [ 620.053455][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 620.068226][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 620.075433][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 620.083702][T24906] binder: 24801:24906 got transaction to invalid handle [ 620.115537][T24906] binder: 24801:24906 transaction failed 29201/-22, size 0-0 line 2994 03:37:33 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x3f}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x80000) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x801, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000240)={0x0, 0xe1, "d3cb6014bd43d52406928ac851f712e5b22f6444643de37d75580886a282d62d8646f49ac10b1dc7f602c50d03ce2d1861c3d7586beca9fdf3b328aae4c40709cb5b0684ca007912983079813ad58a9b146812096f8d13fd40f913c473c0b7591e4a0d7bef31e69e8718016c51a5c7439cbb653a69ea2544ce0776207ad0cc089e7406c93fc67ba710854fc3a60ade76091c508807372c063af6c6688160ad908cdf8a4e7281f3e984a647d6006d30801de194bcaed0be080c5fc1f2f302e9060b7398f465053e51931c45ab301f3c3a9453fe0d3ca8ef2c9b70913a73426fa575"}, &(0x7f0000000140)=0xe9) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000001c0)={r3, 0x7, 0xffffffffffffffba, 0x1ff, 0x200, 0x40}, &(0x7f0000000340)=0x14) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x100, 0x10) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) dup3(r0, r1, 0x0) 03:37:33 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe331010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:33 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2858304000000000, 0x0) 03:37:33 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x801) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x28, &(0x7f0000000080)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r1, 0x6, 0x10}, 0xc) 03:37:33 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r0, 0x1, 0x2d, 0x0, &(0x7f00000001c0)) 03:37:33 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x2a58304000000000, 0x0) 03:37:33 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000480)=0x3, 0x4) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000280), 0x10) 03:37:33 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x1, &(0x7f0000000240)=[{0x16}]}, 0x10) close(r0) syz_genetlink_get_family_id$tipc(0x0) [ 620.475353][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 620.481234][ C1] protocol 88fb is buggy, dev hsr_slave_1 03:37:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:34 executing program 5: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:34 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe431010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:34 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x369418c000000000, 0x0) [ 620.745361][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 620.938284][T25170] binder: 25061:25170 got transaction to invalid handle [ 620.953356][T25170] binder: 25061:25170 transaction failed 29201/-22, size 0-0 line 2994 03:37:34 executing program 5: openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video0\x00', 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.stat\x00', 0x0, 0x0) pipe2(&(0x7f0000000280), 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x6868}}, 0x8, 0x40}, &(0x7f0000000100)=0x90) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)={r1, 0x5, 0x5, [0x8, 0x8, 0x3, 0xd1, 0x8]}, 0x12) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:34 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 03:37:34 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x3f00000000000000, 0x0) 03:37:34 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x100, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:34 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe4ffffff00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 621.160566][ T26] audit: type=1326 audit(2000000254.669:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=25177 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:34 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5054000000000000, 0x0) 03:37:34 executing program 5: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000000080)={0x0, 0x106000, 0x5, 0x1000, 0x8001}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:34 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe531010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:35 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5154000000000000, 0x0) 03:37:35 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x4, 0x400000) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:35 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe631010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 621.605579][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:35 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x5254000000000000, 0x0) [ 621.882428][T25530] binder: 25420:25530 got transaction to invalid handle [ 621.889671][T25530] binder: 25420:25530 transaction failed 29201/-22, size 0-0 line 2994 03:37:35 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 03:37:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pwrite64(r0, &(0x7f0000000080)="c2db", 0x2, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 621.958950][ T26] audit: type=1326 audit(2000000255.469:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=25177 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 [ 622.043429][ T26] audit: type=1326 audit(2000000255.549:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=25534 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:35 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) r2 = dup3(r0, r1, 0x80000) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000000)) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:35 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x6054000000000000, 0x0) 03:37:35 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe731010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802) pwritev(r0, &(0x7f00000005c0)=[{&(0x7f0000000200)="ebf6197c8f0c09c6c4c1b47b97fe085335019e8d50a1d022ba4807b0f3eba405f18ae3f1fdf1b8e3bab60a1f78beb480b7695912fa728c7706141226436c356311beb61875793569b8c29e6f8677ba15f654bac1b4a34927a70b04d83cd14bb4262ab1949d56cf2a2cacc6426216e073f39ab25cea7c5e4696736a5e6a8bad742a2638b59e3950ad6cef8bc54382146b5c6363699759fc10295a5ab0b2319c0266d41033fb56c0240e7ed8abc120f7c7e278b4afe80094f0e02d06025e71b7f736b72d6f0dca9c3802627a68b78fc8f65eff38026082a99d66ae577bd502b4d075b30085cf6c49fafc7959c122d2887eebcc8ff4a48e7b851257", 0xfa}, {&(0x7f0000000300)="5aaca74af12fb155b32aa534b99cc4dc30ab022cf61b0ad0a06f64a6f788c32a5d3c93d410ac5ca5010742dc14d7e547d2c5c92dd0990a325b72535e1e62bdc9c3e4779e8f3816fd822a0e5f65beaceb81b0020f41336cbb6f273e33e46ea7c2ad328f5a5a72d6268f", 0x69}, {&(0x7f0000000380)="1551816cd369a92c286f6d5d02aa9130164f44e8728f167e11e2e59fcad93183ffe5fe7f6cd8ec7c7907f22ac88490d071a716b8b924f4f7fcaaf2e74cd2ee49c8930e977b6bc4e90384a48836f08abbc4038c312f185e125665c8ee36bb9f2bc62fc8de8bf0", 0x66}, {&(0x7f0000000400)="f69b3868f7b3384a905126c7556d42339b244f040e4aa066371b4054cfd83647f462ecc93aa937b4afa26e50a1af11956b859697dcd82bb5edf67d4cd0c89bb382b7458f51c85fc38a2d1e393e4af0f11d4ee467f69233e7290b832fcec9b67eaacaa2ed800c6867da91a533b9dc553f42e63500c1e5055ec5e5402f998d48022d325b92af2dc807676976e87c9bf929bdc378c436ec00e85f05a5cb016791f9e8c378f6b1f1856dc5456c11d95a330f1a6c5e15e565483a35c7029df2477fd724dd582b41e0459625286bb5", 0xcc}, {&(0x7f0000000500)="33917d6c5f313c536ee02e8e73cf1a48b1bd5f95307379f94ea0d0dfe22f92ee9a9722fa57601c37820765a312a20bf9c5b24f444d7c5113962499538b001a2d818295d5881563a3c30fd4d33b33b2d1a59c327d4c1437a5fb17e94ddc5636ad467befb8adee4928105f70c266188428c64454852a87bd0532b74c683443077fc9239082e2c7542bd92b42bce7309d4929f37ed08d055d408b62fe0d3800437cb6047a37ebe77c85c129fd", 0xab}], 0x5, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) preadv(r1, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/105, 0x69}], 0x1, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x2, 0x2) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000180)=@req3={0x5, 0xfffffffffffffffc, 0x50000000000, 0xfffffffffffffb7b, 0x1, 0x80000000, 0xfffffffffffff001}, 0x1c) 03:37:35 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x775804c000000000, 0x0) 03:37:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:36 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dsp\x00', 0x1a000, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000300)=""/113) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r2 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x5, 0x10000) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffff9c, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x1, 0x2, 0xfc1b, 0x0, 0x2cf6b5a4}, &(0x7f0000000100)=0x14) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000180)={r3, 0xcd, "1a4cc8d0694483abf8ff8ae61491d6b7ee225f823aa046044310aa1bb7df2bdf9f4dec939e6520c115a3dbc0022975bb88e4eecc6dd98f4acf0da3498c5bba5d07f524a5e8903286c7f0d73328201ddcaa521a1e7e0051f994a4062c787c943474ad5d5919e5d54bdac78df72f2bae7b97847f4f3a5e003809ae65b8a0403931ea0325a837aa0d2b9c919fdbc52bdb8d8e338a41cab38335fa96d8593b8cd476645cf87996009ebb2b510a125472d0e44d4382ded8a6c478a6a352dd11368b7119f14372951f303564984e06dd"}, &(0x7f0000000280)=0xd5) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xe831010000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:36 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x785804c000000000, 0x0) [ 622.495609][ T5] binder: undelivered TRANSACTION_ERROR: 29201 03:37:36 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x8000000000000000, 0x0) [ 622.711168][T25878] binder: 25766:25878 got transaction to invalid handle [ 622.724310][T25878] binder: 25766:25878 transaction failed 29201/-22, size 0-0 line 2994 [ 622.839388][ T26] audit: type=1326 audit(2000000256.349:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=25534 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:36 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0x100000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000028000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000028c0)={&(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbff}, 0xc, 0x0}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 03:37:36 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x2) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x2000, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:36 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) r2 = dup3(r0, r1, 0x0) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000000)=0x1, 0x4) 03:37:36 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xfeffffff00000000, 0x0) 03:37:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0ffffff00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:36 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x4000, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @multicast2, @dev}, &(0x7f0000000180)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@empty}}, &(0x7f0000000440)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@mcast1, @in=@remote, 0x4e23, 0x6, 0x4e21, 0x6, 0xa, 0xa0, 0xa0, 0x33, r1, r2}, {0x5, 0x100000000, 0x0, 0x2, 0x1213, 0x1, 0x0, 0x100000001}, {0x956, 0x2, 0x0, 0x8}, 0x6, 0x0, 0x0, 0x1, 0x1, 0x3}, {{@in=@local, 0x4d5, 0x2b}, 0xa, @in=@remote, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0xfffffffffffffffe}}, 0xe8) pipe(&(0x7f0000000080)={0xffffffffffffffff}) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x27, &(0x7f00000001c0)={@rand_addr, @loopback, 0x0}, &(0x7f0000000200)=0xc) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000240)=r4) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f0000000280)={{0x200, 0x7}, 'port1\x00', 0x23, 0x6, 0x9, 0x40, 0xa277, 0x0, 0x6, 0x0, 0x2, 0x3}) r5 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$VIDIOC_S_PRIORITY(r3, 0x40045644, 0x0) 03:37:36 executing program 0: r0 = socket(0x10, 0x20000000000003, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0}) recvmmsg(r0, &(0x7f00000029c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10102, &(0x7f0000001540)={r1}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000040c0)=ANY=[@ANYBLOB='\x00'], 0x1}}, 0x0) 03:37:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:36 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xffefffffff7f0000, 0x0) 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) ioctl$BLKROTATIONAL(r1, 0x127e, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x40000000000010}) socket$inet6_tcp(0xa, 0x1, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000340)='security.ima\x00', &(0x7f0000000380)=@sha1={0x1, "43b6dafd980aaa9fd8c49ab0fb274a39b4b21d60"}, 0x15, 0x2) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000002c0)=0x14) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000300)={r3, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x24}}, 0xc) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000180)="9a9ae0f7f1ff07e4d7dd4bd57b9a55079d81036993fef3b2849e751df5bc6873a0b0f2971bc9f516b6ab8ac7ac21e94df066098679d6dbc9e9cc214602c391669317b1f331beb792c5dfd74f191f4becaba0188a2c71db2a359c23be622520469a52d1af137ea27b348eca5e7f78f1ff9ae54ae0b17a82f146c7b72b5903b6b0cc7e45d17b8a84e61e2683f4e1db76a1f504409a081d849809fb5d6fe047bf6af829546f607c97c470ba29c55a4ae306c3d97166880db624a43f93a3787c2acb3c41d56d1ceee2f2d86dfd95fd25feef564930182635bba4f2379481f2d2c1bf2aa46884c1f3494337f425c83252d0aae5b1662b68b91614ae0fb6cd29d7de5c") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x329, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:36 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfeffffff00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 623.345477][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:37 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xffffffff00000000, 0x0) 03:37:37 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x101200, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000180)={{{@in=@empty, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@local}}, &(0x7f00000000c0)=0xe8) fstat(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r1, &(0x7f0000000300)={0xa0, 0x19, 0x1, {0x2204, {0x82, 0x2, 0x8}, 0x20, r2, r3, 0x0, 0x2, 0x1f, 0xfff, 0x5, 0x5, 0x2, 0x5, 0x3, 0xffffffffffff7fff, 0x101, 0x6, 0x7, 0x20, 0x7}}, 0xa0) [ 623.521221][T26227] binder: 26124:26227 got transaction to invalid handle [ 623.556379][T26227] binder: 26124:26227 transaction failed 29201/-22, size 0-0 line 2994 03:37:37 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0xffffffffff600000, 0x0) 03:37:37 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f0000000340)=""/126, 0xa47a430c8e75e3ef) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xff7f000000000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) rt_sigaction(0x28, &(0x7f0000000100)={&(0x7f0000000080)="66abf20f2b2964400fed861da50000c4c16dfbb4a403000000c44190124cb203c441ed62f6c40235935467000fc5c700139a99899999f295", {0x5f}, 0x0, &(0x7f00000000c0)="f30f2d07c4626da929f3ad660f382aa934835dffc4a1ddf144a5002ef3400f5ad647ef26f3362e6747f73db0290000f26f36400f186200"}, &(0x7f0000000240)={&(0x7f0000000180)="c4237bf04cb76e008fa978cbc4f3af660f3a22f90026664e0f7eec66410fd7c4c4a311420700c46241b9bc1934de00003666430f383e914284a234c422fd25bd00800000", {}, 0x0, &(0x7f0000000200)="650f71e7edc4e17d66f7c4427d19f68fc838ee308d360fd2788746f6b30900000083c2014319e68f6900909d0000000046f6b909000000"}, 0x8, &(0x7f0000000280)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000340)={0x0, 0xde, "50d98b4dfdc7f821ac05b4753572c8ac25f80b0c057dca79e7fe1ca00f27e46f2076705aac9922697860ce450ff79c440f471dfc41f8fa4248848bd09b6ffe13906cae5f9d29ada5b0d68bdddedd4d0a028419e931b5e1780c11da6261111407760185e88178ed5e270954abaaa0182e5da4fb5cdc4f360724b75ce429f719b3a642f4f9800cf9a7c51ac313741d45230d096ddddf208b8c2234327092986f35aa672ee773beaadb718960f9956d5359d92643cc61c26bd34f68b3e38a7c53426b297d6184be2d651b63e1ae5dcbbcc58f5a77877bbf37f9ffcb137ba572"}, &(0x7f0000000440)=0xe6) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000480)={r3, 0x8, 0x1, [0x312]}, &(0x7f00000004c0)=0xa) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cachefiles\x00', 0x202000, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f0000000300)=0x2) getsockopt$inet6_dccp_buf(r4, 0x21, 0xc0, &(0x7f0000000500)=""/184, &(0x7f00000005c0)=0xb8) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r5, 0x114, 0xa, &(0x7f0000000600)={0x1, '\b'}, 0x2) 03:37:37 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x2) 03:37:37 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000580)=[{0x6, 0x0, 0x0, 0xfffffffffffffffd}]}) msgget$private(0x0, 0x0) [ 624.130830][ T26] audit: type=1326 audit(2000000257.639:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=26350 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:37 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x4, 0x40) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r1, 0xc0505350, &(0x7f00000000c0)={{0x400, 0x101}, {0x6, 0xbf75}, 0x3, 0x0, 0xbc55}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 624.225589][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:37 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffff7f00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:37 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="00fb4704010fda1a3a0300000000000000e70a2107f89b492fcf8e704b9c6a6434ba3ec2af71967cfdeff98c7d4830ea3cc412762a09f55add0de5a86fc8ab2fd6080000000000"], 0x47, 0x2) write$binfmt_elf32(r0, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x80000001, 0x2, 0xfffffffffffffff8, 0xa3a, 0x9, 0x2, 0x3, 0xd134, 0x2c9, 0x38, 0x211, 0x3, 0x1, 0x20, 0x1, 0x8000, 0x7f73, 0x1}, [{0x60000001, 0x80000000, 0x9, 0x7, 0x3ff, 0x0, 0xffffffffffffff81, 0x3}], "190a3750a419626857b7ab85c06c7ffb91aae83bf59670750cd9e1315ca49c4140b94571c788b337d23ccba5bb9a7ef4a1699d5fd81e3c2cd47ad76a5a953aecc1ddfba7e0ea6e67eeeb470980dcb3a6d78eb916edd42f7d55da98", [[], [], [], [], []]}, 0x5b3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 624.346453][T26570] binder: 26466:26570 got transaction to invalid handle [ 624.353457][T26570] binder: 26466:26570 transaction failed 29201/-22, size 0-0 line 2994 03:37:38 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffffff00000000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:38 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x100, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:38 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000100)=0x0, &(0x7f0000000200), &(0x7f0000000240)) fchmod(r0, 0x2) write$P9_RGETATTR(r1, &(0x7f0000000280)={0xa0, 0x19, 0x2, {0x4, {0x84, 0x2, 0x5}, 0x8, r2, r3, 0x6, 0x81, 0x1a9c, 0x3, 0x4, 0x3, 0x1, 0x8000, 0x7f5, 0x401, 0x9, 0x101, 0x7f, 0x6, 0x8}}, 0xa0) [ 624.920232][ T26] audit: type=1326 audit(2000000258.429:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=26350 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45aeda code=0xffff0000 03:37:38 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) write$selinux_attr(r0, &(0x7f0000000000)='system_u:object_r:hwdata_t:s0\x00', 0x1e) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) 03:37:38 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xffffffff87600000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:38 executing program 5: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x2000, 0x0) ioctl$SIOCX25GDTEFACILITIES(r0, 0x89ea, &(0x7f00000001c0)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x40, 0x0) poll(&(0x7f0000000200)=[{r1, 0x400}, {r1, 0x40}], 0x2, 0xfff) accept$packet(r2, &(0x7f0000000a80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000ac0)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000b00)={@dev={0xfe, 0x80, [], 0xf}, r3}, 0x14) setsockopt$netrom_NETROM_T4(r2, 0x103, 0x6, &(0x7f00000000c0)=0x7fff, 0x4) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000000280)={@default, @default}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000240)=0x7, 0x4) [ 625.090045][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:40 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x1b54) 03:37:40 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x5, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_XSAVE(0xffffffffffffffff, 0x9000aea4, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 03:37:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:40 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xfffffffffffff000, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:40 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x100000000) clone(0x80000000, &(0x7f00000007c0)="43b3430bb4c0616a899470583d165c7e20399a7be22222b95719cd5b5b54a6005337044d9e5b3cbc08f1bc98448e3af1fd9acad24831a1a1d2d749f5945f4a17eabf39fbd1a50900ba00f1a97f21ccaacdc124361b29652f7fd7d38f1ab89fcc85271b1a674f80fb2cb703fb20bdb22b7d3b6ee7f9a40efe42bb1e30858994ac88e4a1d20b57e6209ebe67a326ec2eec8edd6bfc8f0573255b4a6f9ab7816180834ae9c99a1bae19372d62e7754e29d7e067c2a49d7e3f6cdea71caf5a02651bf7f9d5d71d84a32c9a8b8fc2e7da790d737184defa64b841606a62d937f90a2eeb1b391025109473e6615967e5865765a1b5d9e98a3ab8c62195755baaed890e9e2c013c0bafbc8e89c450553b520be57dd613d997cdd6a08c5e759afa5d95c85697a89f254c87030ed64b01e35e8ec156876cd6ca062cfa357c6937018abd0ac15ff5c1dd79ea1ab62718b76129c3d02f543f1178970087014eddae3fb363ef7d858c4b07d4c7235194015862c40d", 0x0, 0x0, 0x0) close(r1) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000040)=@v2={0x2000000, [{0x3, 0x401}, {0x11ca, 0x9}]}, 0x14, 0x1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) mmap(&(0x7f00003e2000/0x3000)=nil, 0x3000, 0x1, 0x6010, r1, 0x0) dup3(r0, r1, 0x0) 03:37:40 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x2154) 03:37:40 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0x0, 0x800) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) getpgrp(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 627.287041][T27133] binder: 27015:27133 got transaction to invalid handle [ 627.313575][T27133] binder: 27015:27133 transaction failed 29201/-22, size 0-0 line 2994 03:37:40 executing program 0: 03:37:40 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:40 executing program 0: 03:37:41 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x3f00) 03:37:41 executing program 0: 03:37:41 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x2}) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:41 executing program 5: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000080), 0x4) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:41 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x4000) [ 627.985390][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:41 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x1, 0x42880) bind$llc(r1, &(0x7f0000000040)={0x1a, 0x8, 0xfffffffffffffffa, 0x2, 0x2, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x10) r2 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r2) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r2, 0x0) 03:37:41 executing program 0: 03:37:41 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:41 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x5054) 03:37:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$TIOCEXCL(r2, 0x540c) r3 = dup3(r1, r0, 0x80000) write$P9_RLINK(r3, &(0x7f0000000100)={0x7, 0x47, 0x2}, 0x7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 628.085014][T27383] binder: 27274:27383 got transaction to invalid handle [ 628.113077][T27383] binder: 27274:27383 transaction failed 29201/-22, size 0-0 line 2994 03:37:41 executing program 0: 03:37:41 executing program 0: 03:37:41 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x5154) 03:37:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xff72, 0x0, 0x0, 0x345, 0x0, &(0x7f0000000080)='\x00'}) 03:37:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:42 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000240)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb c\x8a\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x01\xc4\xd9bN\xa1\xd2\v\xbc\rl\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$ext4(0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0, 0x80000, 0x0) 03:37:42 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x40, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000080)={0x1c00000000000, 0x6}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x805) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) [ 628.835348][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 [ 629.002187][T27625] binder: 27521:27625 got transaction to invalid handle [ 629.009350][T27625] binder: 27521:27625 transaction failed 29201/-22, size 0-0 line 2994 03:37:42 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00003e1000/0x3000)=nil, 0x3000}, 0x1}) r1 = userfaultfd(0x1) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x400, 0x0) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x3f) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) read(r0, &(0x7f00000000c0)=""/126, 0x7e) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = eventfd2(0x0, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)) io_setup(0x5, &(0x7f0000000100)=0x0) ioctl$void(r3, 0xc0045878) io_submit(r6, 0x1, &(0x7f0000329fd8)=[&(0x7f00002a8000)={0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x1, r4}]) read$eventfd(r4, &(0x7f00000000c0), 0x8) connect$netrom(r3, &(0x7f0000000140)={{0x3, @null, 0x2}, [@default, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}, 0x48) lseek(r1, 0x0, 0x0) dup3(r0, r1, 0x0) 03:37:42 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:42 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x5254) 03:37:42 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) pwritev(r0, &(0x7f0000001600)=[{&(0x7f0000000500)="94709e10efc415ec34671c303d8658c70f8fa472ba991e078faaa344fbf9b1195efffdbd69cc0905106e9f03bdfa92397a644d6c6fd8a03745d984bfea76dc48f13430bc0c6c86fc95f1e2038adfaf9ccc502461e6c4f859027c1a9eb39013094462a33971c11bf1b45c992e7ef0fd47ff7a1dc65de3515ef1a16a56cbf720131322caf00116af8a6e59459b4d6a922448420746209c1275d9495a3c03d393e0966b4c8ef67b3f737d264b63253ffe5f37905f9cd1426f24f7e3c2c14fc38969628ef10b762eed05703616a9f08b94f022c597832e0aaa1bb4436ed8844a2930bcb45bb59a4b2012aaba3045b531a721a04e3138a87c6c739f29c4e9f5dc20d6cc9103549c55212cbe060fc31697c99340fad7a0be027a38e11e0f873b6e6661c1b2d1115c8137921d8b37c07a85c1fe7e014d252f0cb8869e61b245cd6d83f80d6948c8cc8f4c14ffe87df4c0edd8ab464f755710b5a6ac8b08fc67f560a9beffa564f5e37f39dd3850b66a4215a9890661a4fbfe13068fb0000aee325a4c5f9904f26c112bb45c086a328d67165898611661942b51ce53fe01b8946c68aea0bdc3f0d0753cdd22f5f0ea7511eed2cb6ec342436684d32a1b1f7b32fab75c53fd0c5ad53adb3be71060fc10a9dac36bb7f91d6256144dba03e98449a465eb75196b1eb0ffc3db83379fa6f577e2e9e3a2302754075bd868397bcb3430280a29364a639edd8b0d357072a539f8b2a5cc37c28e4947d05d1c34b9e1edaf133b2500af6efcbf07d9d714f0d2d6d707255f16b294789f474ece00263dfa8153d78ba58c97a1605893c9bb4f4b13da4edd340df681c35563b257f45afd43d285a46d1ce45f641b26a1db13a73839ed4e28b94ea4171e8f0186c987db94b264f42e0788031e0dc7081817fe5003c8e9c593c7c3e6706244b162f9358d291c04435f49cd91d26e01b24d6445e10442741c047bf0e225d6956d95df9f0f8e9d0625f7162e12fcb40582758886b44efa22f7ff5bce1ad2b7b88b392d887ab7c708caeed68e81ea1e78069ebb134985d2b3378a33b821b13e4c1238b4cd91dbaac90ac27f4feebf1dcf47ce558f84def0742e8842ba96e635e04db005183333f5fc811c075a28ce057835d6ce534b63d27844045eea98339d0769238e1b82c957210037e11371672fc4c059f988306bf32c287577d9d7c4401dcdcb33f3803841effb24aac6114a1e187690705e031e14da9b18e567f3841e67965e83f9232e73a854afe96c1fb674a0c693a355be9c0f3726f2ac08d6294e1a808eb779b195d1356cbea1300caf3df291c662e2b281e90adcefa59942e8e324a85ed96c4149faa31eda042055d80856cf4bce2f557ad1b3afaffe78d20dfbc70c12268890a380546f579860c187e3e36ce74298ba081ede60634fecf016156f475a9dbdcbdef23a61d747f7a9f2267b29352da4b707ed989bd63143923226a2a371ea750bb6d8a8d082854e146b20101c34c0651543ddcfbfedd300778b2519c5efdab8d894083864b91dc909483260e2ed5a2ec17840390ae4d9123ac66f8b9d28937454659b1c3652acc23d75a2cc2b023ca698b930f494c75b6c545a92ee7693c52a40f1cd2815c11894d6f04426416d7274ccfa067bceb3c59c019855bbef9594c992b91d630fb29838a0778aa6ae4a4906c4c46f1f13a1cb97b1cf04a1a4e9babce0f5536fae490b89f9a70409c5837280a57b3648ccd829a83873670adc99d2aac408dfc5e1b7370296e0d503e02311768c588c46e8361b7fd023cc9546661ccfc1d70c623daa30e1bf5e17c7bdab9f7fc10e520e3fddc72a1c8087941109d43c33550e138fb20443404637a9182bf89fc305d8d0a82c50a020cc23ac4a49bc3b1cdc4ba8be967c55ea95032bb88103233eaa473fc298723e7b4894459897baec0a6b414bfc8a33c8d15896b75af2b7175345d9caa4790c42a87355ef7c301b6fda8db5b2109c21843b5ad2c8c544e6108e126a112c74abb0c773f7ad49cf89f43e241b07b2afc73704315c1515e81dc43585e546d8878c6ffde1955772e13dca3e06b46a43be67dce1cfe87b311447bedaf4cfef8793b1ff0e170e9a68497d95ae19248af8b544485fac142d9e80ee9146d33f05b88ec00e2be5fa5591979cc30c5e8ef9048966282e0e155d5ba848cf51abe1e951e34373caa382bf259618e1c8bcb270e944fd1d0325d657dfe0382ab70408bec28e2ad7503b0d44bc3fb48942445a4828408c112804b090938ce177443bbbac0b0d836c6b00044a85563ecf0130e5a9170a901b31a2c3be7ac53c71f4f803dc212dcdc5faf7fa39284468c3ce2ceda94d29c721adc98372233c9630b3b75d75a0e49d980f607398b89ffdbea4964bcecb493db4f8fad3da9aa4fe4a6d7e5d26eb8cc201fe74bcf93ea85d722ad1a11c988549cae59fadc05aaf87d6836ffa48329f2bbc3773be5f0ef63f87afa81ce5b0a02887ef523e4f08dabe498fb594f23ebe5246e1b56803c3324a804a63374fb850c76186b68ca89fdb9e61877c7ea29bd02018f733afba46166528c5a41a90335c6c3c1bcfac48439816be5dff057e4912ed35906a2fb3f0b28afc3296c9ea75fa90c1b7263eee67cdb540e2cf8b427e43bf5d35f499f6f6b05ca34e519df9563cef42ca83c7c2f625d500de533f2586de35ad9bb836d5c74e026fc7020c938f25710d0b32a1126521e42cc8a7fc96d69dcae8eed175cdbce078b20dff601b0b1c39872d138b2c19bbc23b68ecd60e673d88b8fd8d3f6b72559008b6aeca5ab01f54935a942b16ecf6c0b0b7039c4595a4c7f23d3b8e29f1751f616339210be553246616093b83a4f406cd9a19ba48595c51f0fae7ff871f91cffc6dabbc47a105f656773eca7debe0f77f0630a910d644c0c5421b0dff8adda5dc683be7c26002ad01e7e0aee1cf8ed4401d9593a224e45c7a542a6a1592c02dc5d88189fd348d5b4ce2a598cd33de44d0d0729c81793609bba6b27bd0850490c29f70c990cbe46bee6b4b52f59e3e80ad4f303aeedd99b0bae64d43ed580e069ebc90c4296984fb38d2721016b50078b973cfc0cf21b9fcc14819765d5119aa277122ef25d662aff2ed9e61085a9e57bceec9ab6c298f88a588325e1182588ac36c4e95ed18f759b95bc14cba31aec78500ba8beb877de54f8b55ce545b55b98edca5ade96f5dc675bbc0adb26687a5d219c1afc2ef82eb34c68aa1f322a1b3ab63e5e8869297104aeacec29a2c1ddc3c7bcbd1a8d36307f4ca3338092649522151a74c42951f0fa564efdc68ae12b3294c628419618bbfe475a63fbdd70e1583e8397b44434c6b4ccd927972ef500abd7a6c73c8bb86d43c014aa85b007e5f8f3307c154d241978f72335b1bac2366183f1d126460ebfc63211b05980b036746516ac16d4b49d6cb89929686856fcc639dc20f0d3b57ba8ca2022500c93ffcab503dba36c9b17ab4e88707de2a07598cf7fc646d6896bfe5e7879457b9b641a60d8bc301a818d253284ff4543658586817ab731ccc4ea4f47292961309341e8e870d4d1a11f88bf0822d6833753f828235d93b83863946b446308e6992df3ab3d179dcbbde290a194751b6bbafe5dd1c973af44fc31a500ed82a3934f0bc2693eb452581c728f76189f54a2500e6f90a25edede2e75d114ce0f319cdddcd7417636e6e6a6c86f1d5edb12ae4b2dedbb09da382d5a0943d6533cd1a9904bf4c776836b415cdb1dc4b7accc8943cf7fe65bfdd1797999206d9ab7f32e6f85100ce5426df73670dede444d0fcd427e04384dbe50ce551a8c42bf5f3a82846b334a4e427bf449b97a39c313bd059df0d0fcd1decbe336cd36d216763588de3bbcaf8fcc08d3052d4842b30397d3296396491d7487aa09b59d2b8a16b3c4d633cf715f9dcd4dda1c886776782a84c1381ee925d48dc6fd40ebad40af98aba4c1f66f3a424fe11e6362c3352a739e907ea9c287c7de5064a67ce924ca662391339a8496a2d270c471dd3abcf24e56be2b741264d7730adffac7783b7584aa57ab975d6afd3d65d3fadd2cc0d8da5805483a08ed812305dec58bab7608fa54d85658a3f968629146cb1de2733f56847b6e1fcc74339df8778d4a6a77fb2d5eedd8f184f0d0c20adb6a8376bc987e8e0f8ac7b4c31d94041fe27f2638b848dd4e23c642cbe57294f32bdf492be6f6698795070ae1157ef7bca70d3a5e7da96d0d73e9c43d4de4191750462df54c27f04b04ad309160f25ed1c4e37a64735d28836fe80b6fb99b5c6e972245c4b37f1c2bc30a094d709ea10345b5429798c83728b102d3ecf187fa6204ec2a35c11d8b5c2a6ab5df0099267a7a61b13bbe6fff39f4991a9b43f7f8e1e1cbaf7e141fb99926ca1c0f4de4af35aeb12453d6537eea00145c9339b9142a68a9dfab01f8bbfe4fd3baab0ea565d97866119fd9bf6385f8e377208b5cd0e87f6720109164a5432628121798ad5ed2fbdbfb6526d2a5803dc75e80d69bba6af70362f9dc9d7d5d4d7993d3dfaee070ac8f4175ee354c5ae6dc3debb9f43adc7effce015b5683fb2beec01cf412ccae46f23275fd9086b57c6c8d8e5c56cbc2da7bc4e71af6ed2c7d5a35c21ec76da237bdd0e5f86a97856b1192830f5828cfb0a337b76430af96879825c9b077e076eae9d1a4ff3603875f0d584bc974d85a7d8f886644ae562809bdd4a2b8e4bec798e6f2a06b49ebb708c9fa81e7d39e43b2cd24b4d3819962d03da69f22edf1ae7f1d45c621e8e5ed589829b9cc9bbebbbe16379c8e6b14b708e93a312100a6550615fa7f33ad9d8df4bf0e0cfaffc3d93c3b9b3c13784fe22fbb6b3efeebb18755688bea86c505e8edbacec4fa1961d0a03698edb38d90d0f4503c25f3e17ba5327f4ed87e76f528f4aae481013572eb4dd9502a50463a8494efb9bf1ebfd2f0581a75d6fba02eea53cfd8288f856997bc397571dc720bf4d548e0c12c44de591d34e3b01479d4c62e025b16841992c825ae6a7954767a224d1fe4b01703681b3ee6dbeff0417ed36cca541b3c557b1c462405b89b68bd989e69fe6dcab1218f67b7ddf61fb1abca01cdeb2296c1fc0f0dc6ec3ec86b84f064496b5b8436b563372d219811fc04f94adb9d502a8f5c98c0c4d1f9354e04b8e751e59a487daef47100add054b593d5c9dcd63bb92b62bb41204bbb9cbef9b7f8ba9e1ea6217a3e3afd7759ac02a2447b4a56bf26e7cd934304d6affa305e2cb2f9ca1ca9a94f1091c48a7f41326790e550f375df180be45f121a40c13a7544fcbf45f336770efb415f6929d9c3cc23780c10450befa85257883b074ba0f3450275e770d5de585573a7aeac5481f239cc23c9b75cd6bfc56c702ec05d91d7224fb1e62ab5648a4f57772458be90d150fe7b0b9ea441dfd70b0ce83736744caab23ce7482e08f3c21e88a9f349221e39f51bf85ac49683fbfb2caef8fd0cde1924479009e9f47433ccdeacd4996fe0f011f6cc6aa3ad0", 0xf3c}], 0x1, 0x0) 03:37:42 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x101000, 0x0) setsockopt$netrom_NETROM_T4(r1, 0x103, 0x6, &(0x7f0000000080)=0x3fc, 0x33266c3f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:42 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x541b) 03:37:42 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x2000, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000000c0)={0x0, 0xbbf, &(0x7f0000000180)="d894842d3ea712accbd74c097a325acaa5173702892f1049960a2efc1b413c966846d0351ee27207c286ab32bceaaa01839d735f694658f2ad4c0d87043ba27177e75e3991d73236e4d27d6f4ac61b1e904e9145f2a44cd47ce477c1273ea1535b2efbc85725427b6eaa75766d30e2da2397cf2ab80cf8ab4343d26474fb3fa95da78d2e65da5fb92e1bde90bac6d7", &(0x7f0000000240)="23bf7ea978fb01b3ce855c143584f1af4ec8f1b0d6901ba8d27f8de1c6ba665357f9ea6ff72a239d5133d8b9c31113d47d51c58d00b9482fee31298762c184015b2e1885aa98b7c3b7685d039bd9f865012826692ab27e4fe7434dd2c867bc0b6b0da0eb471a68a0ce41f0b5eec8d6367d2e54c8f91f825a11fb4af0a975ddbb184bf0f8020781dec84deeb26349b2861224d2cd7e6df3fafef996db5e27", 0x8f, 0x9e}) 03:37:42 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:42 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet(0x2, 0x3, 0x19) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000480)=ANY=[@ANYBLOB="000000000000000002000000e000000100000000000000000000000000000000000000000000000000000000000000000000b821de8d6e282cea8641bcd11da0000000000000000000000000000000000000000000000000000000000000000000000000006ee135720818cc660000000000000000000000000000000000000000000000000000000000000000000000c60dd5efe4cf17880e1203adbe84011937e05672371013c73211f2e75f0b7ceea5ab969647a2d98a36294844980c264e4425d00864d45f38c12f3d3a9ff205b489c196291d968c34de4d723d83456460f1b8fe92793875f3f19bb37352cb62be53932fc08c5940"], 0x1) 03:37:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2, 0x4, 0x8, 0x6, 0x7fffffff, 0x5, 0x2, 0x9, 0x4, 0xfffffffffffffff9, 0xdb, 0x0, 0x5, 0x4082, 0x9f3, 0xcb, 0x7, 0x6f, 0xe5fe, 0xdab, 0x32b4e660, 0x5, 0x8, 0x6, 0xff1, 0x8, 0x1f0, 0x3ff, 0x8, 0xe52, 0x400, 0x0, 0xf090a9b, 0x2, @perf_bp={&(0x7f0000000040), 0x1}, 0x304, 0x80000000, 0x4, 0x3, 0x6, 0x7fffffff, 0x7ff}, 0xffffffffffffffff, 0x6, 0xffffffffffffff9c, 0x8) r2 = open(&(0x7f0000000240)='./file0\x00', 0x41, 0x80) write$UHID_INPUT2(r2, &(0x7f0000000280)=ANY=[], 0x0) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/.yz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = msgget(0x2, 0x420) msgctl$IPC_STAT(r4, 0x2, &(0x7f00000012c0)=""/244) r5 = openat$cgroup_procs(r3, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001400)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000001600)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000015c0)={&(0x7f0000001440)={0x154, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffffffff}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0x25}, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e23, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x29f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x0, @ipv4={[], [], @loopback}, 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @loopback, 0x103e3aac}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4040040}, 0x4) msgsnd(r4, &(0x7f00000002c0)={0x2}, 0x8, 0x800) write$cgroup_pid(r5, &(0x7f0000000180), 0x12) rt_sigpending(&(0x7f0000000300), 0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) r7 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x2, 0x2) ioctl$HDIO_GETGEO(r7, 0x301, &(0x7f0000000180)) 03:37:43 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x20000, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000180)=""/160) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x80, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r2, 0x3) syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0xfffffffffffffff7, 0x10000) 03:37:43 executing program 0: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) io_setup(0x1, &(0x7f00000000c0)=0x0) io_submit(r1, 0x1, &(0x7f00000005c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0, 0x0, 0x3}]) r2 = gettid() timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000016) 03:37:43 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x5421) 03:37:43 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) 03:37:43 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x6}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f00003e3000/0x2000)=nil, 0x2000}, 0x2}) r1 = userfaultfd(0x0) clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0) close(r1) rt_sigtimedwait(&(0x7f0000000080)={0x2}, &(0x7f00000001c0), &(0x7f0000000140), 0x8) read(r0, &(0x7f00000000c0)=""/126, 0xffffff63) nanosleep(&(0x7f0000000180)={0x77359400}, 0x0) dup3(r0, r1, 0x0) [ 629.705469][ T7862] binder: undelivered TRANSACTION_ERROR: 29201 03:37:43 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x5450) 03:37:43 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r1 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@l2, &(0x7f0000000100)=0x80, 0x80000) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000180)={0x3, 0x6, 0x7, @dev={[], 0x12}, 'lo\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) 03:37:43 executing program 4: clone(0x3102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0xc0000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x10}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x5451) 03:37:43 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 630.008233][T28017] binder: 27891:28017 got transaction to invalid handle [ 630.035366][T28017] binder: 27891:28017 transaction failed 29201/-22, size 0-0 line 2994 03:37:43 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) r1 = dup(r0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0xde3, @dev={0xfe, 0x80, [], 0x1b}, 0x3}, @in={0x2, 0x4e22, @empty}, @in6={0xa, 0x4e23, 0x9, @empty, 0x6}], 0x48) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='\x00'}) [ 630.102148][T28101] ================================================================== [ 630.110285][T28101] BUG: KASAN: use-after-free in lockdep_register_key+0x3b9/0x490 [ 630.118005][T28101] Read of size 8 at addr ffff8880a914ed98 by task syz-executor.3/28101 [ 630.126233][T28101] [ 630.128577][T28101] CPU: 1 PID: 28101 Comm: syz-executor.3 Not tainted 5.0.0-next-20190306 #4 [ 630.138724][T28101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 630.148781][T28101] Call Trace: [ 630.152084][T28101] dump_stack+0x172/0x1f0 [ 630.156419][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.161788][T28101] print_address_description.cold+0x7c/0x20d [ 630.167762][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.173123][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.178493][T28101] kasan_report.cold+0x1b/0x40 [ 630.183258][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.188638][T28101] __asan_report_load8_noabort+0x14/0x20 [ 630.194263][T28101] lockdep_register_key+0x3b9/0x490 [ 630.199467][T28101] alloc_workqueue+0x427/0xe70 [ 630.204235][T28101] ? bond_init+0x17a/0x800 [ 630.208673][T28101] ? find_held_lock+0x35/0x130 [ 630.213442][T28101] ? bond_init+0x17a/0x800 [ 630.217869][T28101] ? workqueue_sysfs_register+0x3f0/0x3f0 [ 630.223597][T28101] ? lock_downgrade+0x880/0x880 [ 630.228454][T28101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 630.234704][T28101] bond_init+0x1b3/0x800 [ 630.238952][T28101] ? bond_set_rx_mode+0x4c0/0x4c0 [ 630.243983][T28101] register_netdevice+0x300/0xff0 [ 630.249038][T28101] ? netdev_change_features+0xb0/0xb0 [ 630.254400][T28101] bond_newlink+0x4b/0x90 [ 630.258722][T28101] ? bond_changelink+0x1ac0/0x1ac0 [ 630.263833][T28101] __rtnl_newlink+0x107b/0x16c0 [ 630.268668][T28101] ? rtnl_link_unregister+0x250/0x250 [ 630.274022][T28101] ? lock_downgrade+0x880/0x880 [ 630.278874][T28101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 630.285121][T28101] ? is_bpf_text_address+0xd3/0x170 [ 630.290306][T28101] ? kernel_text_address+0x73/0xf0 [ 630.295414][T28101] ? __kernel_text_address+0xd/0x40 [ 630.300606][T28101] ? unwind_get_return_address+0x61/0xa0 [ 630.306258][T28101] ? __save_stack_trace+0x8a/0xf0 [ 630.311278][T28101] ? save_stack+0xa9/0xd0 [ 630.315599][T28101] ? save_stack+0x45/0xd0 [ 630.319920][T28101] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 630.325708][T28101] ? kasan_kmalloc+0x9/0x10 [ 630.330193][T28101] ? kmem_cache_alloc_trace+0x151/0x760 [ 630.335729][T28101] ? rtnl_newlink+0x4b/0xa0 [ 630.340234][T28101] ? rtnetlink_rcv_msg+0x465/0xb00 [ 630.345364][T28101] rtnl_newlink+0x69/0xa0 [ 630.349679][T28101] ? __rtnl_newlink+0x16c0/0x16c0 [ 630.354685][T28101] rtnetlink_rcv_msg+0x465/0xb00 [ 630.359616][T28101] ? rtnetlink_put_metrics+0x560/0x560 [ 630.365070][T28101] ? __lockdep_free_key_range+0x120/0x120 [ 630.370766][T28101] ? netdev_pick_tx+0x300/0x300 [ 630.375599][T28101] ? netlink_deliver_tap+0x22d/0xc00 [ 630.380886][T28101] ? find_held_lock+0x35/0x130 [ 630.385640][T28101] netlink_rcv_skb+0x17a/0x460 [ 630.390406][T28101] ? rtnetlink_put_metrics+0x560/0x560 [ 630.395853][T28101] ? netlink_ack+0xb50/0xb50 [ 630.400460][T28101] ? kasan_check_read+0x11/0x20 [ 630.405333][T28101] ? netlink_deliver_tap+0x254/0xc00 [ 630.410636][T28101] rtnetlink_rcv+0x1d/0x30 [ 630.415059][T28101] netlink_unicast+0x536/0x720 [ 630.419825][T28101] ? netlink_attachskb+0x770/0x770 [ 630.424929][T28101] ? _copy_from_iter_full+0x259/0x8f0 [ 630.430292][T28101] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 630.436016][T28101] ? __check_object_size+0x3d/0x42f [ 630.441195][T28101] netlink_sendmsg+0x8ae/0xd70 [ 630.445950][T28101] ? netlink_unicast+0x720/0x720 [ 630.450876][T28101] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 630.456434][T28101] ? apparmor_socket_sendmsg+0x2a/0x30 [ 630.461896][T28101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 630.468128][T28101] ? security_socket_sendmsg+0x93/0xc0 [ 630.473585][T28101] ? netlink_unicast+0x720/0x720 [ 630.478513][T28101] sock_sendmsg+0xdd/0x130 [ 630.482922][T28101] ___sys_sendmsg+0x806/0x930 [ 630.487610][T28101] ? copy_msghdr_from_user+0x430/0x430 [ 630.493084][T28101] ? __schedule+0x81f/0x1cc0 [ 630.497656][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 630.503110][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 630.508581][T28101] ? lockdep_hardirqs_on+0x418/0x5d0 [ 630.513877][T28101] ? retint_kernel+0x2d/0x2d [ 630.518568][T28101] ? trace_hardirqs_on_caller+0x6a/0x220 [ 630.524209][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 630.529669][T28101] ? retint_kernel+0x2d/0x2d [ 630.534267][T28101] ? sockfd_lookup_light+0x78/0x180 [ 630.539923][T28101] ? sockfd_lookup_light+0x9f/0x180 [ 630.545141][T28101] __sys_sendmsg+0x105/0x1d0 [ 630.549723][T28101] ? __ia32_sys_shutdown+0x80/0x80 [ 630.554822][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 630.560295][T28101] ? do_syscall_64+0x26/0x610 [ 630.564961][T28101] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 630.571016][T28101] ? do_syscall_64+0x26/0x610 [ 630.575705][T28101] __x64_sys_sendmsg+0x78/0xb0 [ 630.580471][T28101] do_syscall_64+0x103/0x610 [ 630.585045][T28101] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 630.590920][T28101] RIP: 0033:0x458079 [ 630.594795][T28101] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 630.614381][T28101] RSP: 002b:00007f8913ac5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 630.622791][T28101] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458079 [ 630.630748][T28101] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004 [ 630.638706][T28101] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 630.646684][T28101] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8913ac66d4 [ 630.654642][T28101] R13: 00000000004c5674 R14: 00000000004d9550 R15: 00000000ffffffff [ 630.662606][T28101] [ 630.664983][T28101] Allocated by task 17732: [ 630.669406][T28101] save_stack+0x45/0xd0 [ 630.673559][T28101] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 630.679186][T28101] kasan_kmalloc+0x9/0x10 [ 630.683509][T28101] kmem_cache_alloc_trace+0x151/0x760 [ 630.689039][T28101] alloc_perf_context+0x49/0xf0 [ 630.693895][T28101] find_get_context.isra.0+0x145/0x5c0 [ 630.699540][T28101] __do_sys_perf_event_open+0xbfb/0x24e0 [ 630.705182][T28101] __x64_sys_perf_event_open+0xbe/0x150 [ 630.710748][T28101] do_syscall_64+0x103/0x610 [ 630.715343][T28101] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 630.721220][T28101] [ 630.723539][T28101] Freed by task 0: [ 630.727260][T28101] save_stack+0x45/0xd0 [ 630.731419][T28101] __kasan_slab_free+0x102/0x150 [ 630.736377][T28101] kasan_slab_free+0xe/0x10 [ 630.740877][T28101] kfree+0xcf/0x230 [ 630.744760][T28101] free_ctx+0x42/0x50 [ 630.748779][T28101] rcu_core+0x928/0x1390 [ 630.753098][T28101] __do_softirq+0x266/0x95a [ 630.757589][T28101] [ 630.759919][T28101] The buggy address belongs to the object at ffff8880a914ec80 [ 630.759919][T28101] which belongs to the cache kmalloc-512 of size 512 [ 630.774788][T28101] The buggy address is located 280 bytes inside of [ 630.774788][T28101] 512-byte region [ffff8880a914ec80, ffff8880a914ee80) [ 630.788493][T28101] The buggy address belongs to the page: [ 630.794222][T28101] page:ffffea0002a45380 count:1 mapcount:0 mapping:ffff88812c3f0940 index:0xffff8880a914e780 [ 630.804377][T28101] flags: 0x1fffc0000000200(slab) [ 630.809320][T28101] raw: 01fffc0000000200 ffffea000222f948 ffffea00023d3048 ffff88812c3f0940 [ 630.817930][T28101] raw: ffff8880a914e780 ffff8880a914e000 0000000100000004 0000000000000000 [ 630.826508][T28101] page dumped because: kasan: bad access detected [ 630.832914][T28101] [ 630.835237][T28101] Memory state around the buggy address: [ 630.840876][T28101] ffff8880a914ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 630.848942][T28101] ffff8880a914ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 630.857028][T28101] >ffff8880a914ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 630.865088][T28101] ^ [ 630.869942][T28101] ffff8880a914ee00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 630.878099][T28101] ffff8880a914ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 630.886246][T28101] ================================================================== [ 630.894310][T28101] Disabling lock debugging due to kernel taint [ 630.900548][T28101] Kernel panic - not syncing: panic_on_warn set ... [ 630.907138][T28101] CPU: 1 PID: 28101 Comm: syz-executor.3 Tainted: G B 5.0.0-next-20190306 #4 [ 630.917208][T28101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 630.927264][T28101] Call Trace: [ 630.930573][T28101] dump_stack+0x172/0x1f0 [ 630.935004][T28101] panic+0x2cb/0x65c [ 630.938902][T28101] ? __warn_printk+0xf3/0xf3 [ 630.943489][T28101] ? lock_downgrade+0x880/0x880 [ 630.948338][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.953708][T28101] ? trace_hardirqs_off+0x62/0x220 [ 630.958817][T28101] ? trace_hardirqs_off+0x59/0x220 [ 630.963941][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.969324][T28101] end_report+0x47/0x4f [ 630.973482][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.978853][T28101] kasan_report.cold+0xe/0x40 [ 630.983718][T28101] ? lockdep_register_key+0x3b9/0x490 [ 630.989104][T28101] __asan_report_load8_noabort+0x14/0x20 [ 630.994745][T28101] lockdep_register_key+0x3b9/0x490 [ 631.001451][T28101] alloc_workqueue+0x427/0xe70 [ 631.006320][T28101] ? bond_init+0x17a/0x800 [ 631.010744][T28101] ? find_held_lock+0x35/0x130 [ 631.015693][T28101] ? bond_init+0x17a/0x800 [ 631.020116][T28101] ? workqueue_sysfs_register+0x3f0/0x3f0 [ 631.025846][T28101] ? lock_downgrade+0x880/0x880 [ 631.030784][T28101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.037033][T28101] bond_init+0x1b3/0x800 [ 631.041541][T28101] ? bond_set_rx_mode+0x4c0/0x4c0 [ 631.046576][T28101] register_netdevice+0x300/0xff0 [ 631.051607][T28101] ? netdev_change_features+0xb0/0xb0 [ 631.057004][T28101] bond_newlink+0x4b/0x90 [ 631.063074][T28101] ? bond_changelink+0x1ac0/0x1ac0 [ 631.068302][T28101] __rtnl_newlink+0x107b/0x16c0 [ 631.073167][T28101] ? rtnl_link_unregister+0x250/0x250 [ 631.078625][T28101] ? lock_downgrade+0x880/0x880 [ 631.083476][T28101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.089733][T28101] ? is_bpf_text_address+0xd3/0x170 [ 631.094947][T28101] ? kernel_text_address+0x73/0xf0 [ 631.100063][T28101] ? __kernel_text_address+0xd/0x40 [ 631.105258][T28101] ? unwind_get_return_address+0x61/0xa0 [ 631.110892][T28101] ? __save_stack_trace+0x8a/0xf0 [ 631.116016][T28101] ? save_stack+0xa9/0xd0 [ 631.120359][T28101] ? save_stack+0x45/0xd0 [ 631.124682][T28101] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 631.130581][T28101] ? kasan_kmalloc+0x9/0x10 [ 631.135080][T28101] ? kmem_cache_alloc_trace+0x151/0x760 [ 631.140625][T28101] ? rtnl_newlink+0x4b/0xa0 [ 631.145125][T28101] ? rtnetlink_rcv_msg+0x465/0xb00 [ 631.150275][T28101] rtnl_newlink+0x69/0xa0 [ 631.154609][T28101] ? __rtnl_newlink+0x16c0/0x16c0 [ 631.159639][T28101] rtnetlink_rcv_msg+0x465/0xb00 [ 631.164684][T28101] ? rtnetlink_put_metrics+0x560/0x560 [ 631.170154][T28101] ? __lockdep_free_key_range+0x120/0x120 [ 631.175875][T28101] ? netdev_pick_tx+0x300/0x300 [ 631.180724][T28101] ? netlink_deliver_tap+0x22d/0xc00 [ 631.186010][T28101] ? find_held_lock+0x35/0x130 [ 631.190773][T28101] netlink_rcv_skb+0x17a/0x460 [ 631.195536][T28101] ? rtnetlink_put_metrics+0x560/0x560 [ 631.201005][T28101] ? netlink_ack+0xb50/0xb50 [ 631.205594][T28101] ? kasan_check_read+0x11/0x20 [ 631.210437][T28101] ? netlink_deliver_tap+0x254/0xc00 [ 631.215725][T28101] rtnetlink_rcv+0x1d/0x30 [ 631.220156][T28101] netlink_unicast+0x536/0x720 [ 631.225089][T28101] ? netlink_attachskb+0x770/0x770 [ 631.230198][T28101] ? _copy_from_iter_full+0x259/0x8f0 [ 631.235565][T28101] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 631.241286][T28101] ? __check_object_size+0x3d/0x42f [ 631.246481][T28101] netlink_sendmsg+0x8ae/0xd70 [ 631.251587][T28101] ? netlink_unicast+0x720/0x720 [ 631.256519][T28101] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 631.262067][T28101] ? apparmor_socket_sendmsg+0x2a/0x30 [ 631.267530][T28101] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 631.273776][T28101] ? security_socket_sendmsg+0x93/0xc0 [ 631.279237][T28101] ? netlink_unicast+0x720/0x720 [ 631.284180][T28101] sock_sendmsg+0xdd/0x130 [ 631.288614][T28101] ___sys_sendmsg+0x806/0x930 [ 631.293300][T28101] ? copy_msghdr_from_user+0x430/0x430 [ 631.298769][T28101] ? __schedule+0x81f/0x1cc0 [ 631.303363][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 631.308819][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 631.314451][T28101] ? lockdep_hardirqs_on+0x418/0x5d0 [ 631.319733][T28101] ? retint_kernel+0x2d/0x2d [ 631.324322][T28101] ? trace_hardirqs_on_caller+0x6a/0x220 [ 631.329959][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 631.335421][T28101] ? retint_kernel+0x2d/0x2d [ 631.340013][T28101] ? sockfd_lookup_light+0x78/0x180 [ 631.345210][T28101] ? sockfd_lookup_light+0x9f/0x180 [ 631.350503][T28101] __sys_sendmsg+0x105/0x1d0 [ 631.355095][T28101] ? __ia32_sys_shutdown+0x80/0x80 [ 631.360236][T28101] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 631.365816][T28101] ? do_syscall_64+0x26/0x610 [ 631.370490][T28101] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 631.376562][T28101] ? do_syscall_64+0x26/0x610 [ 631.381267][T28101] __x64_sys_sendmsg+0x78/0xb0 [ 631.386044][T28101] do_syscall_64+0x103/0x610 [ 631.390648][T28101] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 631.396536][T28101] RIP: 0033:0x458079 [ 631.400426][T28101] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 631.420033][T28101] RSP: 002b:00007f8913ac5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 631.428466][T28101] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458079 [ 631.436444][T28101] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004 [ 631.444509][T28101] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 631.452482][T28101] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8913ac66d4 [ 631.460454][T28101] R13: 00000000004c5674 R14: 00000000004d9550 R15: 00000000ffffffff [ 632.621088][T28101] Shutting down cpus with NMI [ 632.626591][T28101] Kernel Offset: disabled [ 632.630910][T28101] Rebooting in 86400 seconds..