nfmt_misc(r2, &(0x7f0000000080)=ANY=[], 0x4240a3c3) splice(r1, 0x0, r3, 0x0, 0x10003, 0x0) 02:23:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000600000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:18 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 02:23:18 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0xda4fff08) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r1) write$cgroup_int(r1, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r1) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_int(r1, &(0x7f0000000040)='cpuset.cpu_exclusive\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x660c, 0xfeffffff00000000) r3 = openat$cgroup_ro(r1, &(0x7f0000000380)='cpu.sta\xf4\x00', 0x0, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x4) recvmsg$kcm(r1, &(0x7f0000000400)={&(0x7f0000000200)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, 0x0, 0x0, &(0x7f0000001500)=""/4096, 0x1000}, 0x100) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x1) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000080)={r3}) bpf$PROG_LOAD(0x5, &(0x7f0000002500)={0x16, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f00000000c0)=""/9, 0x41100, 0x1, [], r4, 0xf}, 0x48) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, 0x0) [ 425.278919] binder_alloc: 21394: binder_alloc_buf size 4893816 failed, no address space 02:23:18 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 425.330010] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 425.382594] binder: 21394:21396 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:18 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x12, 0x100, 0x4, 0x81, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa]}, 0x2c) 02:23:18 executing program 3: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r1) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x0, 0x0, 0x3, 0xffffffff7ffffffb}, 0xffffffffffffff71) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f0000000180), 0x30a) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000700)='pids.current\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4, 0x10}, 0xffffffffffffffcc) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r4) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000380)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;<\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xc6\x0f\xd7\x14\x0f\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4N') r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540)='/dev/net/tun\x00', 0x8d41e965388e3f09, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x118) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000780)={'nr0\x01\x00', 0x802}) perf_event_open(&(0x7f00000007c0)={0x2, 0x70, 0x9, 0x4, 0x0, 0x80000000, 0x0, 0x2ee095d, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x43f8, 0xfffffffffffffff9, 0x1aff, 0x0, 0x81, 0x0, 0x4, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xd9b3, 0x9, 0x0, 0x0, 0x1, 0xf9ed, 0x31, 0xc1d, 0x3f, 0x100000000, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x3400, 0x6, 0x6, 0x0, 0x406, 0x0, 0x5906af8b}, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x24, 0x0, r3}, 0x2c) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) socket$kcm(0x11, 0x0, 0x300) write$cgroup_int(r5, &(0x7f0000000000), 0x12) close(r1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x127) 02:23:18 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 425.423717] binder_alloc: binder_alloc_mmap_handler: 21394 20a00000-20e00000 already mapped failed -16 [ 425.450659] binder: BINDER_SET_CONTEXT_MGR already set [ 425.457480] binder_alloc: 21394: binder_alloc_buf, no vma 02:23:18 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 425.499886] binder: 21394:21409 ioctl 40046207 0 returned -16 [ 425.519647] binder: undelivered TRANSACTION_ERROR: 29201 [ 425.532407] binder: 21394:21411 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:18 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)="9a", 0x1}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 425.590285] binder: undelivered TRANSACTION_ERROR: 29189 02:23:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000680000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:18 executing program 2: [ 425.722805] binder_alloc: 21430: binder_alloc_buf size 4893816 failed, no address space [ 425.738668] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 425.750511] binder_alloc: binder_alloc_mmap_handler: 21430 20a00000-20e00000 already mapped failed -16 [ 425.783611] binder: BINDER_SET_CONTEXT_MGR already set [ 425.788949] binder: 21430:21431 ioctl 40046207 0 returned -16 [ 425.803284] binder_alloc: 21430: binder_alloc_buf, no vma [ 425.833315] protocol 88fb is buggy, dev hsr_slave_0 [ 425.838404] protocol 88fb is buggy, dev hsr_slave_1 [ 425.993263] protocol 88fb is buggy, dev hsr_slave_0 [ 425.998339] protocol 88fb is buggy, dev hsr_slave_1 02:23:19 executing program 1: 02:23:19 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x100000000002, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:19 executing program 2: 02:23:19 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)="9a", 0x1}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000006c0000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:19 executing program 5: 02:23:19 executing program 2: [ 426.362333] binder_alloc: 21445: binder_alloc_buf size 4893816 failed, no address space 02:23:19 executing program 5: 02:23:19 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:19 executing program 1: [ 426.413786] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 426.432304] binder_alloc: binder_alloc_mmap_handler: 21445 20a00000-20e00000 already mapped failed -16 [ 426.451351] binder: BINDER_SET_CONTEXT_MGR already set 02:23:19 executing program 2: [ 426.488197] binder: 21445:21446 ioctl 40046207 0 returned -16 02:23:19 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:19 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)="9a", 0x1}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:19 executing program 5: 02:23:19 executing program 1: 02:23:19 executing program 2: 02:23:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000740000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:19 executing program 5: 02:23:19 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:19 executing program 1: 02:23:19 executing program 2: [ 426.719242] binder_alloc: 21481: binder_alloc_buf size 4893816 failed, no address space [ 426.747762] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:19 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)="9a", 0x1}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:19 executing program 1: [ 426.828543] binder_alloc: binder_alloc_mmap_handler: 21481 20a00000-20e00000 already mapped failed -16 02:23:19 executing program 5: [ 426.872598] binder: BINDER_SET_CONTEXT_MGR already set 02:23:19 executing program 2: 02:23:19 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:19 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 426.924077] binder: 21481:21482 ioctl 40046207 0 returned -16 02:23:19 executing program 5: [ 427.009406] binder_alloc: 21481: binder_alloc_buf, no vma 02:23:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000004aac780000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:20 executing program 1: creat(0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) fcntl$setlease(r0, 0x400, 0x0) 02:23:20 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_PIE_ON(r0, 0x7005) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000001380)=""/4096, 0x1000}], 0x1, 0x0) 02:23:20 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:20 executing program 5: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @random="ffcecd6284d3", [], {@mpls_mc={0x8848, {[], @ipv6={0x0, 0x6, "dc4c7b", 0x8, 0x0, 0x0, @local, @local, {[], @udp={0x0, 0x0, 0x8}}}}}}}, 0x0) 02:23:20 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 427.196209] binder_alloc: 21523: binder_alloc_buf size 4893816 failed, no address space 02:23:20 executing program 0: r0 = socket$kcm(0x10, 0x0, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:20 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x2c) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x21a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000]}, 0x2c) 02:23:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCGSTAMPNS(0xffffffffffffffff, 0x8907, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x20, 0x4) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 427.239559] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 427.275226] binder_alloc: binder_alloc_mmap_handler: 21523 20a00000-20e00000 already mapped failed -16 02:23:20 executing program 0: r0 = socket$kcm(0x10, 0x0, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:20 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 427.314026] binder: BINDER_SET_CONTEXT_MGR already set [ 427.333353] binder: 21523:21531 ioctl 40046207 0 returned -16 [ 427.350054] binder_alloc: 21523: binder_alloc_buf, no vma 02:23:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000007a0000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:20 executing program 0: r0 = socket$kcm(0x10, 0x0, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 427.584086] binder_alloc: 21558: binder_alloc_buf size 4893816 failed, no address space [ 427.621649] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 427.639215] binder_alloc: binder_alloc_mmap_handler: 21558 20a00000-20e00000 already mapped failed -16 [ 427.652248] binder: BINDER_SET_CONTEXT_MGR already set [ 427.663857] binder: 21558:21560 ioctl 40046207 0 returned -16 [ 427.664029] binder_alloc: 21558: binder_alloc_buf, no vma 02:23:20 executing program 2: clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, 0x0) dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x7, 0x20000000, 0xca}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:23:20 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:20 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:20 executing program 0: socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) 02:23:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000fffffdfd0000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:20 executing program 5: dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f0000000100)) 02:23:21 executing program 0: socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 428.014996] binder_alloc: 21574: binder_alloc_buf size 4893816 failed, no address space [ 428.038544] ptrace attach of "/root/syz-executor.2"[21580] was attempted by "/root/syz-executor.2"[21581] [ 428.053974] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)) write$cgroup_int(r1, &(0x7f0000000080), 0x2001007f) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000240)=ANY=[@ANYBLOB="049249240000000013"]) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xbcda34450b800b7a, 0x40000000000a132, 0xffffffffffffffff, 0x0) 02:23:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) 02:23:21 executing program 0: socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3735858", 0x39}], 0x1}, 0x0) [ 428.137804] binder: BINDER_SET_CONTEXT_MGR already set 02:23:21 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={r0}) [ 428.183418] binder_alloc: 21574: binder_alloc_buf, no vma 02:23:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 428.240802] binder: 21574:21575 ioctl 40046207 0 returned -16 02:23:21 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, 0x0, 0x0) 02:23:21 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x18}, 0x2c) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x7f, 0x7, 0x5, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000080), 0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r0, &(0x7f00000002c0), 0x0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r0, &(0x7f00000000c0)}, 0x10) 02:23:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000020000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:21 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={r0}) 02:23:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000100)={0x43}, 0x43) 02:23:21 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, 0x0, 0x0) 02:23:21 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r0, &(0x7f0000000080)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={r0}) [ 428.432467] binder_alloc: 21616: binder_alloc_buf size 4893816 failed, no address space [ 428.451533] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)) write$cgroup_int(r1, &(0x7f0000000080), 0x2001007f) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000240)=ANY=[@ANYBLOB="000000000000000013"]) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xbcda34450b800b7a, 0x40000000000a132, 0xffffffffffffffff, 0x0) [ 428.514888] binder_alloc: 21616: binder_alloc_buf, no vma [ 428.515437] binder: BINDER_SET_CONTEXT_MGR already set [ 428.548749] binder: 21616:21617 ioctl 40046207 0 returned -16 02:23:21 executing program 5: 02:23:21 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, 0x0, 0x0) 02:23:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000030000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:21 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000100)={0x43}, 0x43) 02:23:21 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:21 executing program 2: 02:23:22 executing program 2: mkdir(&(0x7f0000000280)='./control\x00', 0x0) capset(&(0x7f00000000c0)={0x19980330}, &(0x7f0000000100)={0x4, 0x5}) chdir(&(0x7f0000000140)='./control\x00') r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) 02:23:22 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, 0x0}, 0x0) [ 429.016114] binder_transaction: 13 callbacks suppressed [ 429.016137] binder: 21644:21647 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$sock_int(r0, 0x1, 0x3, &(0x7f000059dffc), &(0x7f0000000040)=0x4) 02:23:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000100)={0x43}, 0x43) 02:23:22 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r0}) [ 429.125044] capability: warning: `syz-executor.2' uses 32-bit capabilities (legacy support in use) [ 429.133068] binder_alloc_mmap_handler: 2 callbacks suppressed [ 429.133084] binder_alloc: binder_alloc_mmap_handler: 21644 20a00000-20e00000 already mapped failed -16 [ 429.162580] binder: BINDER_SET_CONTEXT_MGR already set 02:23:22 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, 0x0}, 0x0) 02:23:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 429.181332] binder: 21644:21647 ioctl 40046207 0 returned -16 02:23:22 executing program 5: clone(0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) mlock2(&(0x7f00007b2000/0x2000)=nil, 0x2000, 0x0) [ 429.286178] binder_alloc: 21644: binder_alloc_buf, no vma 02:23:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000040000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:22 executing program 2: ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000001c0)='/dev/usbmon#\x00') getsockopt$MISDN_TIME_STAMP(0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) unshare(0x20000000) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) close(0xffffffffffffffff) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="c7da5f1a", 0x4) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x500, 0x10000000000443) sigaltstack(&(0x7f0000804000/0x1000)=nil, 0x0) writev(r1, &(0x7f00000006c0)=[{&(0x7f0000000600), 0x60020}], 0x1) read(r1, &(0x7f00000003c0)=""/72, 0x100000104) sendmsg$xdp(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="9d", 0x1}], 0x1}, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x1) 02:23:22 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r0}) 02:23:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:22 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, 0x0}, 0x0) [ 429.340173] binder: 21644:21677 transaction failed 29189/-3, size 4893815-0 line 3035 [ 429.358301] binder_release_work: 13 callbacks suppressed [ 429.358308] binder: undelivered TRANSACTION_ERROR: 29201 [ 429.375397] binder: undelivered TRANSACTION_ERROR: 29189 02:23:22 executing program 5: [ 429.462305] binder: 21690:21692 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:22 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)}, 0x0) 02:23:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 429.526777] binder_alloc: binder_alloc_mmap_handler: 21690 20a00000-20e00000 already mapped failed -16 02:23:22 executing program 5: [ 429.569961] binder: BINDER_SET_CONTEXT_MGR already set 02:23:22 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r0}) [ 429.623238] binder: 21690:21692 ioctl 40046207 0 returned -16 02:23:22 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)}, 0x0) 02:23:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 429.688712] binder_alloc: 21690: binder_alloc_buf, no vma [ 429.727349] binder: 21690:21714 transaction failed 29189/-3, size 4893815-0 line 3035 [ 429.750688] binder: undelivered TRANSACTION_ERROR: 29201 [ 429.761761] binder: undelivered TRANSACTION_ERROR: 29189 02:23:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000050000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 429.866594] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 429.866604] binder_alloc: 21726: binder_alloc_buf size 4893816 failed, no address space [ 429.881477] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 429.881485] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 429.897033] binder: 21726:21727 transaction failed 29201/-28, size 4893815-0 line 3035 [ 429.907559] binder_alloc: binder_alloc_mmap_handler: 21726 20a00000-20e00000 already mapped failed -16 [ 429.918709] binder: BINDER_SET_CONTEXT_MGR already set [ 429.924116] binder: 21726:21728 ioctl 40046207 0 returned -16 [ 429.924252] binder: 21726:21729 transaction failed 29189/-3, size 4893815-0 line 3035 [ 429.938430] binder: undelivered TRANSACTION_ERROR: 29201 [ 429.944001] binder: undelivered TRANSACTION_ERROR: 29189 02:23:23 executing program 2: 02:23:23 executing program 5: 02:23:23 executing program 3: r0 = socket$kcm(0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:23 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)}, 0x0) 02:23:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000060000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:23 executing program 5: [ 430.293923] binder_alloc: 21734: binder_alloc_buf size 4893816 failed, no address space 02:23:23 executing program 2: 02:23:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:23 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{0x0}], 0x1}, 0x0) 02:23:23 executing program 3: r0 = socket$kcm(0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 430.370568] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 430.401239] binder: 21734:21741 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:23 executing program 5: [ 430.431554] binder_alloc: binder_alloc_mmap_handler: 21734 20a00000-20e00000 already mapped failed -16 02:23:23 executing program 2: [ 430.525482] binder: BINDER_SET_CONTEXT_MGR already set 02:23:23 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{0x0}], 0x1}, 0x0) 02:23:23 executing program 5: [ 430.568421] binder: 21734:21741 ioctl 40046207 0 returned -16 [ 430.601705] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 430.601712] binder_alloc: 21734: binder_alloc_buf, no vma 02:23:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:23 executing program 2: [ 430.675554] binder: undelivered TRANSACTION_ERROR: 29201 [ 430.685498] binder: 21734:21767 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:23 executing program 3: r0 = socket$kcm(0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:23 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{0x0}], 0x1}, 0x0) 02:23:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000070000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:23 executing program 5: [ 430.735334] binder: undelivered TRANSACTION_ERROR: 29189 02:23:23 executing program 2: 02:23:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:23 executing program 5: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file1/file0\x00'}, 0x10) write$binfmt_elf64(r0, &(0x7f0000001380)=ANY=[], 0xffffffe0) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='./file2\x00') rename(&(0x7f0000000340)='./file1/file0\x00', &(0x7f0000000300)='./file2\x00') symlink(&(0x7f0000000280)='./file1\x00', &(0x7f0000000240)='./file1/file0\x00') [ 430.852675] binder_alloc: 21787: binder_alloc_buf size 4893816 failed, no address space 02:23:23 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x82, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) writev(r0, 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) unlink(0x0) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8000, 0x0, &(0x7f0000ff8000/0x8000)=nil) getitimer(0x0, 0x0) setsockopt$netlink_NETLINK_PKTINFO(0xffffffffffffffff, 0x10e, 0x3, 0x0, 0x0) setxattr$trusted_overlay_nlink(0x0, 0x0, 0x0, 0x0, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) 02:23:23 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)}], 0x1}, 0x0) [ 430.908285] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:24 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 430.961404] binder: 21787:21789 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:24 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)}], 0x1}, 0x0) [ 431.030659] binder_alloc: binder_alloc_mmap_handler: 21787 20a00000-20e00000 already mapped failed -16 02:23:24 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:24 executing program 2: pipe(&(0x7f0000000140)={0xffffffffffffffff}) close(0xffffffffffffffff) close(r0) fcntl$getflags(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)) bind(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x0, 0x0, 0x0) [ 431.101550] binder: BINDER_SET_CONTEXT_MGR already set [ 431.101570] binder_alloc: 21787: binder_alloc_buf, no vma [ 431.185546] binder: 21787:21789 ioctl 40046207 0 returned -16 [ 431.188744] binder: undelivered TRANSACTION_ERROR: 29201 [ 431.208244] binder: 21787:21808 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:24 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:24 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)}], 0x1}, 0x0) 02:23:24 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000a0000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 431.270540] binder: undelivered TRANSACTION_ERROR: 29189 [ 431.380230] binder_alloc: 21843: binder_alloc_buf size 4893816 failed, no address space [ 431.406516] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 431.434731] binder_alloc: binder_alloc_mmap_handler: 21843 20a00000-20e00000 already mapped failed -16 [ 431.462255] binder: BINDER_SET_CONTEXT_MGR already set [ 431.474471] binder: 21843:21844 ioctl 40046207 0 returned -16 [ 431.485026] binder_alloc: 21843: binder_alloc_buf, no vma 02:23:24 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:24 executing program 2: setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x2b0) r0 = gettid() ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, 0x0, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@mcast2, 0x117e, 0x1, 0xff, 0x0, 0x3}, 0x20) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)='\f', 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0xc000, 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) lseek(0xffffffffffffffff, 0x0, 0x4) tkill(r0, 0x1000000000016) 02:23:24 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e05926166", 0x1d}], 0x1}, 0x0) 02:23:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000120000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:24 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f0000bd7000)={&(0x7f0000c07e98)=ANY=[@ANYBLOB="000000000000000000000000000000000000000033000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000020001700010000000000000000000000000000000000000000000000fb000000480001006d64350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1}}, 0x0) 02:23:24 executing program 1: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:24 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:24 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x0, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:24 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e05926166", 0x1d}], 0x1}, 0x0) [ 431.870362] binder_alloc: 21856: binder_alloc_buf size 4893816 failed, no address space [ 431.889226] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:24 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000dddfc8)={0x0, 0x0, &(0x7f00008a7000)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c00000003060501ff0080fffd06ff2e0a0000000c000100060000007d0a00010c000200000022fff5f10000"], 0x2c}}, 0x0) getsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0) [ 431.956310] binder_alloc: binder_alloc_mmap_handler: 21856 20a00000-20e00000 already mapped failed -16 02:23:25 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 432.007295] binder: BINDER_SET_CONTEXT_MGR already set [ 432.023094] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 432.044490] binder: 21856:21857 ioctl 40046207 0 returned -16 02:23:25 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e05926166", 0x1d}], 0x1}, 0x0) [ 432.063396] binder_alloc: 21856: binder_alloc_buf, no vma 02:23:25 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x0, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 432.105640] netlink: 'syz-executor.2': attribute type 1 has an invalid length. 02:23:25 executing program 1: socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:25 executing program 5: 02:23:25 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e8837", 0x2b}], 0x1}, 0x0) 02:23:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000480000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:25 executing program 2: 02:23:25 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x0, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:25 executing program 1: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bc070") bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x40000000001, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x7, 0x0, 0x1, 0x14}]}, 0x0, 0x80, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) [ 432.310793] binder_alloc: 21897: binder_alloc_buf size 4893816 failed, no address space 02:23:25 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e8837", 0x2b}], 0x1}, 0x0) [ 432.388832] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:25 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f00000000c0)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [0x0, 0x12c, 0x10000000000]}, 0x1}, 0x80, 0x0}, 0x20008844) 02:23:25 executing program 1: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:25 executing program 5: r0 = socket$kcm(0xa, 0x8000000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000001780)={&(0x7f0000000000)=@in6={0xa, 0x4e22, 0x0, @remote}, 0x80, 0x0}, 0x0) [ 432.435518] binder_alloc: binder_alloc_mmap_handler: 21897 20a00000-20e00000 already mapped failed -16 02:23:25 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x0, 0x0, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 432.482023] binder: BINDER_SET_CONTEXT_MGR already set 02:23:25 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e8837", 0x2b}], 0x1}, 0x0) 02:23:25 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0x6612, 0x0) [ 432.506486] binder: 21897:21899 ioctl 40046207 0 returned -16 [ 432.531890] binder_alloc: 21897: binder_alloc_buf, no vma 02:23:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000004c0000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:25 executing program 5: 02:23:25 executing program 1: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:25 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x0, 0x0, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:25 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b8", 0x32}], 0x1}, 0x0) 02:23:25 executing program 2: 02:23:25 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x0, 0x0, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:25 executing program 5: [ 432.748746] binder_alloc: 21949: binder_alloc_buf size 4893816 failed, no address space [ 432.783511] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:25 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:25 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b8", 0x32}], 0x1}, 0x0) 02:23:25 executing program 2: [ 432.838013] binder_alloc: binder_alloc_mmap_handler: 21949 20a00000-20e00000 already mapped failed -16 [ 432.909221] binder: BINDER_SET_CONTEXT_MGR already set 02:23:25 executing program 5: [ 432.930293] binder: 21949:21950 ioctl 40046207 0 returned -16 [ 432.946818] binder_alloc: 21949: binder_alloc_buf, no vma 02:23:26 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b8", 0x32}], 0x1}, 0x0) 02:23:26 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, 0x0, 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000600000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:26 executing program 2: 02:23:26 executing program 5: 02:23:26 executing program 2: 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3", 0x36}], 0x1}, 0x0) 02:23:26 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r0 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r0, &(0x7f0000000100)={0x43}, 0x43) [ 433.124686] binder_alloc: 21980: binder_alloc_buf size 4893816 failed, no address space 02:23:26 executing program 5: 02:23:26 executing program 2: 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3", 0x36}], 0x1}, 0x0) 02:23:26 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, 0x0, 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 433.240016] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:26 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:26 executing program 2: [ 433.322405] binder_alloc: binder_alloc_mmap_handler: 21980 20a00000-20e00000 already mapped failed -16 [ 433.437155] binder: BINDER_SET_CONTEXT_MGR already set [ 433.442532] binder: 21980:22010 ioctl 40046207 0 returned -16 [ 433.442594] binder_alloc: 21980: binder_alloc_buf, no vma 02:23:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000680000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb3", 0x36}], 0x1}, 0x0) 02:23:26 executing program 5: 02:23:26 executing program 2: 02:23:26 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, 0x0, 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:26 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:26 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:26 executing program 5: 02:23:26 executing program 2: 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb37358", 0x38}], 0x1}, 0x0) 02:23:26 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:26 executing program 2: [ 433.618563] binder_alloc: 22023: binder_alloc_buf size 4893816 failed, no address space [ 433.657602] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 433.700806] binder: BINDER_SET_CONTEXT_MGR already set 02:23:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000006c0000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:26 executing program 5: 02:23:26 executing program 2: 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb37358", 0x38}], 0x1}, 0x0) 02:23:26 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 433.751399] binder: 22023:22025 ioctl 40046207 0 returned -16 02:23:26 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:26 executing program 5: 02:23:26 executing program 2: 02:23:26 executing program 0: r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000039c0)={0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000004d80)="39000000140081ae00002c000500018701546fabcae5e54f7e0592616652e285af71583c7d06a6580e883795c0c54c1960b89c40ebb37358", 0x38}], 0x1}, 0x0) [ 433.886437] binder_alloc: 22050: binder_alloc_buf size 4893816 failed, no address space [ 433.953841] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 433.993080] binder: BINDER_SET_CONTEXT_MGR already set 02:23:27 executing program 2: 02:23:27 executing program 5: 02:23:27 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x0, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 434.000181] binder_alloc: 22050: binder_alloc_buf, no vma [ 434.020249] binder: 22050:22053 ioctl 40046207 0 returned -16 [ 434.060725] binder_transaction: 12 callbacks suppressed [ 434.060741] binder: 22050:22064 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000740000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:27 executing program 2: 02:23:27 executing program 0: 02:23:27 executing program 5: 02:23:27 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:27 executing program 2: 02:23:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:27 executing program 0: 02:23:27 executing program 5: [ 434.235625] binder: 22080:22082 transaction failed 29201/-28, size 4893815-0 line 3035 [ 434.298299] binder_alloc_mmap_handler: 2 callbacks suppressed [ 434.298317] binder_alloc: binder_alloc_mmap_handler: 22080 20a00000-20e00000 already mapped failed -16 02:23:27 executing program 2: [ 434.352289] binder: BINDER_SET_CONTEXT_MGR already set [ 434.383680] binder: 22080:22082 ioctl 40046207 0 returned -16 [ 434.410513] binder_alloc: 22080: binder_alloc_buf, no vma [ 434.419418] binder: 22080:22098 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 434.430103] binder_release_work: 13 callbacks suppressed [ 434.430109] binder: undelivered TRANSACTION_ERROR: 29201 [ 434.461447] binder: undelivered TRANSACTION_ERROR: 29189 02:23:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000007a0000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:27 executing program 0: 02:23:27 executing program 5: 02:23:27 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:27 executing program 2: 02:23:27 executing program 0: 02:23:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:27 executing program 5: 02:23:27 executing program 0: [ 434.620803] binder: 22113:22116 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:27 executing program 2: 02:23:27 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000), 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 434.718061] binder_alloc: binder_alloc_mmap_handler: 22113 20a00000-20e00000 already mapped failed -16 [ 434.750488] binder: BINDER_SET_CONTEXT_MGR already set [ 434.775955] binder: 22113:22116 ioctl 40046207 0 returned -16 [ 434.800207] binder: undelivered TRANSACTION_ERROR: 29201 02:23:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000300000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:27 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x1) write$binfmt_aout(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="835094d5292d443db79ca22c3f2d0a047d53"], 0x12) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1, 0x0, 0x8}) 02:23:27 executing program 5: r0 = socket$unix(0x1, 0x1, 0x0) write$P9_RLINK(0xffffffffffffffff, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) timer_create(0x0, 0x0, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) set_tid_address(0x0) sendto$unix(r0, 0x0, 0x0, 0xfffffffffffffffd, &(0x7f00000004c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 02:23:27 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x800000073) io_setup(0x8, &(0x7f0000000100)=0x0) io_cancel(r2, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x3, 0x4, r1, &(0x7f0000000340)="f37d300c02ce8f391e7b4ee69358e05ab0e9da9a08c7867b359a6ec476aac4c9bedb436942ef09f3bef179f20180972e6c01d6593a949550f7484083420e3f89ddb0e4a6bd7ccf97ae3379d949c1729125c90a267956eb7a96dafeb7569f318bb58aab399c79c538c19b618cdb4e4df5640831438bc5c86093d541c51ab5977b671e652f037a80d6b2b9d96b4f48ed9131a2275d44591746863cb71146203445192191aed14426b227511e772c9df5ad01091cdb1b3f9b404861675fca934ce2dcd0b8c647905f83f0ef7f7cf041fa3514e15c25", 0xd4, 0x40000000010000, 0x0, 0x2, r1}, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mkdir(&(0x7f0000000640)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000000)={0x20000000000006, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20000200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x28) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) write$selinux_attr(r1, 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0xfffffde8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={0xffffffffffffffff, r0, 0x0, 0x9, &(0x7f00000002c0)='ppp0bdev\x00', 0xffffffffffffffff}, 0x30) sched_getscheduler(r3) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)={r0, r0, 0xf, 0x1}, 0x10) 02:23:27 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x0, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:27 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:28 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3a, &(0x7f00000001c0)={@local, @dev, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}, {[@rr={0x7, 0x3}]}}, @icmp=@timestamp_reply={0x7, 0x2}}}}}, 0x0) 02:23:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x0, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 434.992920] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 434.992930] binder_alloc: 22142: binder_alloc_buf size 4893816 failed, no address space 02:23:28 executing program 5: getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xfffffffffffffffe, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) fcntl$getflags(r0, 0x3) 02:23:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x0, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:28 executing program 5: pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) fstat(0xffffffffffffffff, 0x0) write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r0, 0x0, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 02:23:28 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 435.151431] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 435.151446] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 435.291407] binder: 22142:22152 transaction failed 29201/-28, size 4893815-0 line 3035 [ 435.344276] binder_alloc: binder_alloc_mmap_handler: 22142 20a00000-20e00000 already mapped failed -16 [ 435.369103] binder: BINDER_SET_CONTEXT_MGR already set [ 435.375363] binder_alloc: 22142: binder_alloc_buf, no vma [ 435.381014] binder: 22142:22152 ioctl 40046207 0 returned -16 02:23:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000500000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 435.387405] binder: 22142:22179 transaction failed 29189/-3, size 4893815-0 line 3035 [ 435.396130] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.409358] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.487455] binder_alloc: 22181: binder_alloc_buf size 4893816 failed, no address space [ 435.495805] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 435.505523] binder: 22181:22182 transaction failed 29201/-28, size 4893815-0 line 3035 [ 435.516168] binder_alloc: binder_alloc_mmap_handler: 22181 20a00000-20e00000 already mapped failed -16 [ 435.526179] binder: BINDER_SET_CONTEXT_MGR already set [ 435.531550] binder: 22181:22182 ioctl 40046207 0 returned -16 [ 435.537882] binder: 22181:22183 transaction failed 29189/-3, size 4893815-0 line 3035 [ 435.546198] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.553557] binder: undelivered TRANSACTION_ERROR: 29189 02:23:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf32(r2, &(0x7f0000000340)=ANY=[], 0xff0e) close(r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x800000100000001, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @ipv4}}, 0x0, 0x40, 0x0, "5c7d866ff43751f8873fcb0dab400c418118817f88dd32c8a5bd1f96947a61b9c9627f989c7f422dd7658bd36505c1c3e348680b100694e23cb170b6156fe10ef3d50b45685df5fda61c86a7608eaf0a"}, 0xd8) connect$inet6(r3, &(0x7f0000000140), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x355) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000100), 0x28) splice(r1, 0x0, r2, 0x0, 0x100000000, 0x0) connect$unix(r2, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) 02:23:28 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0x2, 0x0, @local={0xac, 0x214, 0x15}}, 0xffd6, &(0x7f0000000640), 0x98, &(0x7f0000000180)=[{0x20}], 0x20}, 0xfc) 02:23:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, 0x0) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:28 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) sendmsg$alg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000140)="e17bbdada45c4b42f94f1d7dffbe98a8d2d6f17b5d02836df6fe07a89b31144cd5357c965e3fa93c9f05b2b9e443bb30", 0x30}, {0x0}], 0x2}, 0x0) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:28 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r2 = socket$kcm(0x29, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000600000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 435.672994] binder_alloc: 22290: binder_alloc_buf size 4893816 failed, no address space 02:23:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, 0x0) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 435.719469] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 435.740859] binder: 22290:22291 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:28 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:28 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x294) connect$inet6(r0, &(0x7f0000000340), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000140), 0x10) pwritev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000100)="2265162d6c36d2d553b535288f726cee2343cd3da80438bbe33926e61647fc7fcab63c030ef325ad0f899dcc3d1baefa9b3b5a978b1e8319bcc3c41f139590cb2be0b46092dbd2174e400b05", 0x4c}], 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, 0x0, &(0x7f0000000080)) [ 435.782888] binder_alloc: binder_alloc_mmap_handler: 22290 20a00000-20e00000 already mapped failed -16 [ 435.854576] binder: BINDER_SET_CONTEXT_MGR already set 02:23:28 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, 0x0) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 435.879980] binder: 22290:22291 ioctl 40046207 0 returned -16 [ 435.897718] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 435.897727] binder_alloc: 22290: binder_alloc_buf, no vma 02:23:28 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)={r0, r1}) 02:23:29 executing program 0: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f00000003c0)='./file0\x00', 0x8000001040, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") r0 = open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) shmctl$SHM_INFO(0x0, 0xe, 0x0) poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) write$P9_RXATTRWALK(r2, 0x0, 0x0) [ 435.948094] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.964752] binder: 22290:22326 transaction failed 29189/-3, size 4893815-0 line 3035 [ 435.972809] binder: undelivered TRANSACTION_ERROR: 29189 02:23:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) 02:23:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000700000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:29 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f00000000c0)={r0, r1}) [ 436.145411] binder_alloc: 22352: binder_alloc_buf size 4893816 failed, no address space 02:23:29 executing program 5: mlock(&(0x7f0000556000/0x400000)=nil, 0x400000) munlockall() 02:23:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 436.191386] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:29 executing program 3: socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0) [ 436.256271] binder_alloc: binder_alloc_mmap_handler: 22352 20a00000-20e00000 already mapped failed -16 [ 436.328328] binder: BINDER_SET_CONTEXT_MGR already set [ 436.351326] binder: 22352:22354 ioctl 40046207 0 returned -16 02:23:29 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @loopback, @loopback}, 0xc) bind$inet(r0, &(0x7f0000000140)={0x2, 0x1}, 0x10) syz_emit_ethernet(0x423, &(0x7f0000000080)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) [ 436.377409] binder_alloc: 22352: binder_alloc_buf, no vma 02:23:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000100)={0x43}, 0x43) [ 436.448660] binder: undelivered TRANSACTION_ERROR: 29201 02:23:29 executing program 2: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x9) ioctl$KVM_ENABLE_CAP(0xffffffffffffffff, 0x4068aea3, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000100)=[{r1, 0x2000}], 0x1, &(0x7f0000000300), &(0x7f0000000340), 0x8) r3 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0xfffffffffffffffc, 0x0) ftruncate(r3, 0x800000000007d8) r5 = open(&(0x7f00000004c0)='./bus\x00', 0x0, 0x0) keyctl$join(0x1, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000240)=0x4000000000000401) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)=ANY=[@ANYBLOB="0000000000000000ffffffff00000000000000000000000000000000000000dfd22fe44b9495fd036a5b98de57ba225fbe43a0a1e12e99c884ab237d4f1f42cc3bd954ff010000a9e32bfb81fba8b9af8f4b6bfb571a83be9efc858cca314b2e4cd0963d0f61613daa495ef85f14709b70b808d5ebbb76ffa5bcb57384bc98e605e92a09cf76f08e79eac0ad3871caa5807fd1b2b07ca3e28148468d1e269b3983461a4b425d60480bffe12616a8d1514e00000000190a44e845785fc109cb308c6ec006e0972c7d445c49bfc8e9f1d6775b73175132cf960287ea10b73224b37b184d8c2c2452e8e139c0e99ea367814689381c0f0000000000000000000000000000"]) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, &(0x7f0000000200)) syz_emit_ethernet(0x0, &(0x7f0000000240)=ANY=[], 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) name_to_handle_at(r3, &(0x7f00000000c0)='./bus\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="2b000000010000009b51de9aa6de77e30dc25b9ccef993b88d6b059316ceab28ea577d7224ab535e77782c"], 0x0, 0x1000) sched_setparam(r0, &(0x7f00000001c0)=0x8) sendmsg$key(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000c40)={0x2, 0x4, 0x4, 0x0, 0x22, 0x0, 0x70bd2a, 0x25dfdbfd, [@sadb_key={0x18, 0x9, 0x5a0, 0x0, "4047496a6f7d104d7b7bdddbedc433dda9871cbe626e64fb0ed3d6dd23e26a3853191ca047c6cad8b4f038c11e36460b68506c25ec2c568298bab29aff65c13ab22068d7203be8b2feea81492d3aee8a666a179568cd384968513e4302108e52495c9dacb41fb0f8d627f1796c8ff3b68261ae2d6afa27b90bbe567fb58c57ec495c80d25998bf9eb2272f0a0bc19fcca8273e3de7c1f02e4318f018824e8c4650ff2e5ddcecbb252fc09035b987886567981db3"}, @sadb_x_policy={0x8, 0x12, 0x2, 0x0, 0x0, 0x0, 0x200, {0x6, 0xff, 0x6, 0x9, 0x0, 0x7, 0x0, @in6=@local, @in=@empty}}]}, 0x110}}, 0x2000000000000000) mlockall(0x7) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000480)={0x0}) ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f0000000600)={r6, 0x1}) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) syz_open_dev$usbmon(&(0x7f00000003c0)='/dev/usbmon#\x00', 0x4, 0x0) munlockall() seccomp(0x1, 0x0, 0x0) 02:23:29 executing program 3: socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0) 02:23:29 executing program 5: sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/sco\x00') remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 02:23:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000a00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000100)={0x43}, 0x43) 02:23:29 executing program 0: mlockall(0x1) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) 02:23:29 executing program 0: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x9) ioctl$KVM_ENABLE_CAP(0xffffffffffffffff, 0x4068aea3, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000100)=[{r1, 0x2000}], 0x1, &(0x7f0000000300), &(0x7f0000000340), 0x8) r3 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0xfffffffffffffffc, 0x0) ftruncate(r3, 0x800000000007d8) r5 = open(&(0x7f00000004c0)='./bus\x00', 0x0, 0x0) keyctl$join(0x1, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f0000000240)=0x4000000000000401) ioctl$FS_IOC_FIEMAP(r5, 0xc020660b, &(0x7f0000000740)=ANY=[@ANYBLOB="0000000000000000ffffffff00000000000000000000000000000000000000dfd22fe44b9495fd036a5b98de57ba225fbe43a0a1e12e99c884ab237d4f1f42cc3bd954ff010000a9e32bfb81fba8b9af8f4b6bfb571a83be9efc858cca314b2e4cd0963d0f61613daa495ef85f14709b70b808d5ebbb76ffa5bcb57384bc98e605e92a09cf76f08e79eac0ad3871caa5807fd1b2b07ca3e28148468d1e269b3983461a4b425d60480bffe12616a8d1514e00000000190a44e845785fc109cb308c6ec006e0972c7d445c49bfc8e9f1d6775b73175132cf960287ea10b73224b37b184d8c2c2452e8e139c0e99ea367814689381c0f0000000000000000000000000000"]) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000140)) ioctl$KVM_RUN(r3, 0xae80, 0x0) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, &(0x7f0000000200)) syz_emit_ethernet(0x0, &(0x7f0000000240)=ANY=[], 0x0) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000440)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) name_to_handle_at(r3, &(0x7f00000000c0)='./bus\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="2b000000010000009b51de9aa6de77e30dc25b9ccef993b88d6b059316ceab28ea577d7224ab535e77782c"], 0x0, 0x1000) sched_setparam(r0, &(0x7f00000001c0)=0x8) sendmsg$key(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000c40)={0x2, 0x4, 0x4, 0x0, 0x22, 0x0, 0x70bd2a, 0x25dfdbfd, [@sadb_key={0x18, 0x9, 0x5a0, 0x0, "4047496a6f7d104d7b7bdddbedc433dda9871cbe626e64fb0ed3d6dd23e26a3853191ca047c6cad8b4f038c11e36460b68506c25ec2c568298bab29aff65c13ab22068d7203be8b2feea81492d3aee8a666a179568cd384968513e4302108e52495c9dacb41fb0f8d627f1796c8ff3b68261ae2d6afa27b90bbe567fb58c57ec495c80d25998bf9eb2272f0a0bc19fcca8273e3de7c1f02e4318f018824e8c4650ff2e5ddcecbb252fc09035b987886567981db3"}, @sadb_x_policy={0x8, 0x12, 0x2, 0x0, 0x0, 0x0, 0x200, {0x6, 0xff, 0x6, 0x9, 0x0, 0x7, 0x0, @in6=@local, @in=@empty}}]}, 0x110}}, 0x2000000000000000) mlockall(0x7) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000480)={0x0}) ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f0000000600)={r6, 0x1}) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) syz_open_dev$usbmon(&(0x7f00000003c0)='/dev/usbmon#\x00', 0x4, 0x0) munlockall() seccomp(0x1, 0x0, 0x0) 02:23:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000100)={0x43}, 0x43) 02:23:29 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x866e) [ 436.763471] binder_alloc: 22484: binder_alloc_buf size 4893816 failed, no address space [ 436.771675] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 436.796827] mmap: syz-executor.5 (22498) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. 02:23:29 executing program 3: socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0) [ 436.900907] binder: BINDER_SET_CONTEXT_MGR already set [ 436.921016] binder_alloc: 22484: binder_alloc_buf size 4893816 failed, no address space [ 436.923257] binder_alloc: binder_alloc_mmap_handler: 22484 20a00000-20e00000 already mapped failed -16 [ 436.936614] binder: 22484:22490 ioctl 40046207 0 returned -16 02:23:29 executing program 0: 02:23:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000100)={0x43}, 0x43) [ 436.960835] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:30 executing program 3: socket$kcm(0x2, 0x200000000000001, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r0}) 02:23:30 executing program 2: 02:23:30 executing program 5: 02:23:30 executing program 0: 02:23:30 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, 0x0, 0x0) 02:23:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000001200000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:30 executing program 2: 02:23:30 executing program 3: socket$kcm(0x2, 0x200000000000001, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r0}) 02:23:30 executing program 2: 02:23:30 executing program 5: [ 437.588969] binder_alloc: 22532: binder_alloc_buf size 4893816 failed, no address space 02:23:30 executing program 0: 02:23:30 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, 0x0, 0x0) 02:23:30 executing program 3: socket$kcm(0x2, 0x200000000000001, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r0}) [ 437.635926] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:30 executing program 5: [ 437.702623] binder_alloc: binder_alloc_mmap_handler: 22532 20a00000-20e00000 already mapped failed -16 02:23:30 executing program 2: [ 437.769351] binder: BINDER_SET_CONTEXT_MGR already set 02:23:30 executing program 0: 02:23:30 executing program 5: [ 437.793011] binder: 22532:22533 ioctl 40046207 0 returned -16 [ 437.854865] binder_alloc: 22532: binder_alloc_buf, no vma 02:23:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000002000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:30 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffc}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000000080)) r1 = creat(&(0x7f00000000c0)='./file1\x00', 0x0) write$P9_RSTATFS(r1, 0x0, 0x0) 02:23:30 executing program 2: perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xffffffff00000001, 0x8, 0x2}, 0x2f) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000400), 0x0, 0x1}, 0x20) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0xca) 02:23:30 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={r0}) 02:23:30 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") write$cgroup_pid(r0, &(0x7f0000000000), 0x73e1aae6) read(r0, 0x0, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x0, 'io'}]}, 0x4) 02:23:30 executing program 5: syz_emit_ethernet(0x3e, &(0x7f0000000140)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) 02:23:31 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:31 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmmsg(r0, &(0x7f0000004fc0)=[{{0x0, 0xffffffffffffff0d, 0x0, 0x0, 0x0, 0xffffffffffffff91}}], 0x300, 0x2, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123d123f3188b070") sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="2e0000001d008103e00f80ecdb4cb9d91f63190400000000000000fb120001000e00da1b40d819a9060015000000", 0x2e}], 0x1}, 0x0) [ 438.042002] binder_alloc: 22577: binder_alloc_buf size 4893816 failed, no address space 02:23:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) 02:23:31 executing program 1: r0 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x0, 0x0) ioctl$CAPI_NCCI_OPENCOUNT(r0, 0x80044327, 0x0) 02:23:31 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={r0}) [ 438.100080] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:31 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r0, 0x8923, &(0x7f0000000140)={'bond0\x00@@\xea\xff\xff\x80\x00\x00\x02\x00', @ifru_names='bond_slave_1\x00'}) [ 438.196265] binder_alloc: binder_alloc_mmap_handler: 22577 20a00000-20e00000 already mapped failed -16 [ 438.238501] binder: BINDER_SET_CONTEXT_MGR already set 02:23:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000003f00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 438.283519] binder: 22577:22578 ioctl 40046207 0 returned -16 02:23:31 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:31 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) 02:23:31 executing program 3: r0 = socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f00000000c0)={r0}) 02:23:31 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvmmsg(r0, &(0x7f0000004fc0)=[{{0x0, 0xffffffffffffff0d, 0x0, 0x0, 0x0, 0xffffffffffffff91}}], 0x300, 0x2, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123d123f3188b070") sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="2e0000001d008103e00f80ecdb4cb9d91f63190400000000000000fb120001000e00da1b40d819a9060015000000", 0x2e}], 0x1}, 0x0) 02:23:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001680)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xc6\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\x19sT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6d\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xecv:\x1ba=\xd7G\xd5)\xeap\xef\x02\x98\xff\xf5f\x160\xb9\x9ay\xec\x82i\xaf\x9b\xe1x\xae\xca\x17\xfa\xfb\x14\xfd=l\x99\xae\xe4\x1dhO]B\x00\x97Z\x99\x9dy\xba\x89M\xba\xe4\xc1\xa6\xef_\x1e5\xafW\xd8(x\"m\a\xe6:?E\x96~\x0e\xe8Y\xbbn\x0f0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x1000000000015) 02:23:32 executing program 1: seccomp(0x1, 0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x200000000058fe4}]}) socketpair$unix(0x1, 0x805, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 02:23:32 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) ioctl(0xffffffffffffffff, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 439.456322] binder: 22796:22797 transaction failed 29201/-28, size 4893815-0 line 3035 [ 439.528039] binder_alloc_mmap_handler: 2 callbacks suppressed [ 439.528058] binder_alloc: binder_alloc_mmap_handler: 22796 20a00000-20e00000 already mapped failed -16 02:23:32 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) ioctl(0xffffffffffffffff, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 439.591954] binder_alloc: 22796: binder_alloc_buf, no vma [ 439.623355] binder: BINDER_SET_CONTEXT_MGR already set [ 439.631055] binder: 22796:22818 ioctl 40046207 0 returned -16 02:23:32 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$sock_int(r2, 0x1, 0x2c, &(0x7f0000000100)=0x6, 0x4) setsockopt(r2, 0x0, 0x0, 0x0, 0x0) [ 439.663888] binder_release_work: 13 callbacks suppressed [ 439.663896] binder: undelivered TRANSACTION_ERROR: 29201 [ 439.675735] binder: 22796:22810 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:32 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 439.705587] binder: undelivered TRANSACTION_ERROR: 29189 02:23:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000006800000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:32 executing program 3: 02:23:32 executing program 0: 02:23:32 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 439.819164] binder: 22831:22832 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:32 executing program 0: 02:23:32 executing program 3: [ 439.895423] binder_alloc: binder_alloc_mmap_handler: 22831 20a00000-20e00000 already mapped failed -16 02:23:32 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 439.962183] binder: BINDER_SET_CONTEXT_MGR already set [ 439.999306] binder: 22831:22832 ioctl 40046207 0 returned -16 [ 440.026187] binder_alloc: 22831: binder_alloc_buf, no vma [ 440.047707] binder: 22831:22849 transaction failed 29189/-3, size 4893815-0 line 3035 [ 440.079844] binder: undelivered TRANSACTION_ERROR: 29201 [ 440.091269] binder: undelivered TRANSACTION_ERROR: 29189 02:23:33 executing program 1: seccomp(0x1, 0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x200000000058fe4}]}) socketpair$unix(0x1, 0x805, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 02:23:33 executing program 0: 02:23:33 executing program 3: 02:23:33 executing program 2: 02:23:33 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000006c00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:33 executing program 0: 02:23:33 executing program 3: 02:23:33 executing program 0: 02:23:33 executing program 3: 02:23:33 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 440.518246] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 440.518256] binder_alloc: 22869: binder_alloc_buf size 4893816 failed, no address space [ 440.545501] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 440.545517] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:33 executing program 2: [ 440.662689] binder: 22869:22870 transaction failed 29201/-28, size 4893815-0 line 3035 [ 440.712124] binder_alloc: binder_alloc_mmap_handler: 22869 20a00000-20e00000 already mapped failed -16 [ 440.752584] binder: BINDER_SET_CONTEXT_MGR already set [ 440.773006] binder: 22869:22870 ioctl 40046207 0 returned -16 [ 440.787084] binder_alloc: 22869: binder_alloc_buf, no vma [ 440.792759] binder: 22869:22886 transaction failed 29189/-3, size 4893815-0 line 3035 [ 440.801043] binder: undelivered TRANSACTION_ERROR: 29201 [ 440.807811] binder: undelivered TRANSACTION_ERROR: 29189 02:23:34 executing program 1: seccomp(0x1, 0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x200000000058fe4}]}) socketpair$unix(0x1, 0x805, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 02:23:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000000)={0x0, 0x9}) 02:23:34 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000040), &(0x7f0000000100)=0x4) 02:23:34 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:34 executing program 3: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000500)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[.\xf6\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4\xc4\x88C\xa2B\x8b\x81\v\xea\t\xf0\x8fw\a\f\x15\xe2\xd0q\xbb\r\x17`s\xec\x85>\xcf\xab9(\xf6.\x15\xcd2-\xf2\xc4\xd8\x00a\xd5\xd9\xb5Z\xd7\xb4\xac\x1d_+k\xd6\x8ag\xdceHE\xd5\x1c\x8a\xbd#\xcc\x82\xca\xc2(\xb6\xe1\x99', 0x2761, 0x0) 02:23:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000007400000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 441.233595] binder_alloc: 22892: binder_alloc_buf size 4893816 failed, no address space [ 441.273406] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:34 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:34 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002e00)=""/58, 0x3a}}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) ioctl$KVM_SET_NR_MMU_PAGES(0xffffffffffffffff, 0xae44, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x0) sched_setaffinity(0x0, 0xffffffb4, &(0x7f0000000280)=0x5) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0xe4, 0x0, 0x304, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x83f1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x27}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}]}, @IPVS_CMD_ATTR_DEST={0x5c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x33}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1dce}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1ff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x11, 0x1}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x405f}]}, 0xe4}, 0x1, 0x0, 0x0, 0x24048014}, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000440)={{{@in=@dev, @in=@multicast2}}, {{}, 0x0, @in=@local}}, &(0x7f00000001c0)=0xe8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="14400000320002ef27b57000fcdbdf25000000041c26ad553db915a41f56078bdb0f8e7ebd34068d7287367e6af167240105b8d3827dcd78e1fc38307ed651a485080f28047473e15d8e015442a1e2a1710c30599d693723ac676da0e6626b0d7d1a5cc87c0fc8ec0d45cd3816"], 0x1}}, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x20002, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000600)) getresgid(&(0x7f0000000680), 0x0, &(0x7f0000000700)) lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)) writev(r3, &(0x7f00000023c0), 0x1000000000000252) setfsgid(0x0) [ 441.282642] binder: 22892:22893 transaction failed 29201/-28, size 4893815-0 line 3035 [ 441.296707] binder_alloc: binder_alloc_mmap_handler: 22892 20a00000-20e00000 already mapped failed -16 02:23:34 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:34 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 441.411143] binder_alloc: 22892: binder_alloc_buf, no vma [ 441.415101] binder: BINDER_SET_CONTEXT_MGR already set [ 441.434874] binder: 22892:22904 transaction failed 29189/-3, size 4893815-0 line 3035 [ 441.440555] binder: 22892:22893 ioctl 40046207 0 returned -16 02:23:34 executing program 0: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) pipe(0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) ioctl$TIOCLINUX5(r0, 0x541b, 0x0) 02:23:34 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 441.471604] binder: undelivered TRANSACTION_ERROR: 29201 [ 441.502270] binder: undelivered TRANSACTION_ERROR: 29189 02:23:35 executing program 1: seccomp(0x1, 0x0, 0x0) seccomp(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x200000000058fe4}]}) socketpair$unix(0x1, 0x805, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 02:23:35 executing program 3: 02:23:35 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:35 executing program 0: 02:23:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000007a00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:35 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:35 executing program 0: 02:23:35 executing program 3: 02:23:35 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 442.076789] binder_alloc: 22933: binder_alloc_buf size 4893816 failed, no address space [ 442.103350] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:35 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 442.171323] binder_alloc: binder_alloc_mmap_handler: 22933 20a00000-20e00000 already mapped failed -16 [ 442.195595] binder: BINDER_SET_CONTEXT_MGR already set 02:23:35 executing program 0: 02:23:35 executing program 3: [ 442.220987] binder: 22933:22934 ioctl 40046207 0 returned -16 [ 442.291326] binder_alloc: 22933: binder_alloc_buf, no vma [ 442.305656] binder: undelivered TRANSACTION_ERROR: 29201 [ 442.362078] binder: undelivered TRANSACTION_ERROR: 29189 02:23:35 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:35 executing program 1: 02:23:35 executing program 3: 02:23:35 executing program 0: 02:23:35 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000078ac4a000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:35 executing program 3: 02:23:36 executing program 0: 02:23:36 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 442.996375] binder_alloc: 22970: binder_alloc_buf size 4893816 failed, no address space [ 443.028337] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:36 executing program 1: 02:23:36 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 443.062762] binder_alloc: binder_alloc_mmap_handler: 22970 20a00000-20e00000 already mapped failed -16 02:23:36 executing program 3: syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x2, 0x7], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300030, 0x3a, 0xf0ffff, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff85, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x3], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:36 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000180)=""/4096, 0x1000) [ 443.149424] binder: BINDER_SET_CONTEXT_MGR already set 02:23:36 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 443.169896] binder: 22970:22972 ioctl 40046207 0 returned -16 02:23:36 executing program 0: socket$kcm(0x2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000000)) 02:23:36 executing program 1: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00000004c0)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xffffffffffff14f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000080)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x4, 0x4, 0xd}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000000200)}, 0x20) socketpair(0x80000000001, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000080), 0x0}, 0x20) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f0, &(0x7f0000000300)='0\x00') [ 443.213528] binder_alloc: 22970: binder_alloc_buf, no vma 02:23:36 executing program 3: socket$kcm(0x2, 0x40000000000005, 0x0) socket$kcm(0xa, 0x5, 0x0) socket$kcm(0x29, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000000200)}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000f00)) socketpair(0x80000000001, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000300)='0\x00') 02:23:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000010000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:36 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:36 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:36 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:36 executing program 1: socket$kcm(0xa, 0x5, 0x0) r0 = socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000000)={r1}) 02:23:36 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 443.409849] binder_alloc: 23018: binder_alloc_buf size 4893816 failed, no address space 02:23:36 executing program 3: r0 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000040)="b3", 0x1, r0) request_key(&(0x7f0000000340)='user\x00\xd2HO\x96\xdd\xa6VA/\xd2\xfaQ\xdd4\xa5\xab\t\v\xd0\x8c\x90\xb1\xfc\a\xeb\b(\xbcG\x0fv\xe6f\x00\xed-\xe1\xc9\r8\xc2Z\xb5\xd6,\xb2\xb67\x8f\xc6\x9a\xf3F\xf9\'\xbc\xb4\xc1\"\xd3;\xc8\xa1xT\xfa1{`\x93\x9f\xde\x04\x1a\xc7\x8b\x86\xa0\rK&k\x04-\xea_%t\xf8\xf0\xa9\xb0\xfb\x81\x12\x02\xb9L\x86\xf7\xd8FF\xd0\x19\xf8\r\\(S\xb7\x9c\xc0\xea\xe7\xe4\xfa\xac\xd8\xd6o\b\xbf1$ \xb8\xfa%\x8e\xc9\xb8\x18\xe6\x12r,Y\x02\xc3\xadU\xeb\xa4\xe8\x06\xc9\xee4\xf9\x94\x1du\x8d\x97\xed\x97xc\xca\x8c\xbf>\x98\xfe9+|\x85\x8fnw(\xb3;\xc9\xdc\x82\xb9\xf4|?g\xfcz6\x1a\xe1\x0eB\xc8D|\xe7\xd3\x94\x97\xba\xa64\xb5\x0f8\x03K', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0xfffffffffffffffe) 02:23:36 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x17, &(0x7f0000000200)=0x6, 0x2) setsockopt$inet_int(r1, 0x0, 0x12, &(0x7f0000000040)=0x3f, 0x4) bind(r1, &(0x7f0000000380)=@in={0x2, 0x4e20}, 0x80) shutdown(r1, 0x0) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x2, 0x18004e20}, 0x10) recvmmsg(r1, &(0x7f0000000180), 0x400000000000370, 0x0, &(0x7f0000000100)={0x77359400}) [ 443.469302] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:36 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 443.533534] binder_alloc: binder_alloc_mmap_handler: 23018 20a00000-20e00000 already mapped failed -16 [ 443.565769] binder: BINDER_SET_CONTEXT_MGR already set 02:23:36 executing program 0: r0 = openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) r2 = socket$kcm(0x2, 0x3, 0x2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x400, 0x0) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, 0x0) perf_event_open(&(0x7f0000000200)={0x3, 0x70, 0x7, 0x1, 0x80000001, 0x2, 0x0, 0x5, 0x88008, 0x2, 0x7, 0x6, 0x200, 0x0, 0x6, 0x8, 0x6, 0xe, 0x800, 0x40, 0x8, 0x7, 0xfffffffffffffff7, 0x9, 0x8, 0xff4, 0x1, 0x7, 0x4, 0x1, 0x1, 0x1f, 0xffffffffffffffff, 0x0, 0x81, 0x2, 0xa2b, 0x3, 0x0, 0x9, 0x3, @perf_config_ext={0x1}, 0x80, 0x3f, 0x6, 0x7, 0xfa0, 0x8001, 0x2}, 0x0, 0xd, r1, 0xa) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x171) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r1) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r2}) perf_event_open(0x0, 0x0, 0x0, r1, 0xb) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89a0, &(0x7f0000000380)='&@[\x00') r4 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = getpid() perf_event_open(&(0x7f0000000300)={0x7, 0x70, 0x9, 0x101, 0x8, 0x1, 0x0, 0x0, 0x40000, 0xd, 0x0, 0x7, 0x1000, 0x1ff, 0x200, 0x101, 0x9, 0x1f, 0x3, 0x0, 0x7ff, 0x1, 0x1ff, 0x2, 0xfff, 0x40, 0x2, 0x673, 0x100, 0xfffffffffffffffa, 0x80, 0x0, 0x8, 0x3, 0x8000, 0x9, 0xe6, 0x40, 0x0, 0x1, 0x0, @perf_config_ext={0x1, 0x20}, 0x80, 0x45, 0x931, 0x7, 0x20, 0x8, 0x80000000}, r5, 0x3, 0xffffffffffffff9c, 0x1) socketpair(0x9, 0x80807, 0xff, &(0x7f0000000040)) perf_event_open(&(0x7f00000015c0)={0x7, 0x70, 0x0, 0x8, 0x9, 0x9c, 0x0, 0x2, 0x8, 0xc, 0x3, 0x6, 0x1, 0x5, 0x1, 0x9, 0x4, 0xa0, 0x5, 0x20, 0x5, 0x8000000000, 0x3, 0x0, 0x7c, 0x5, 0x2, 0x5, 0x8226, 0x2, 0x0, 0x8, 0x7, 0x0, 0x7fff, 0x4, 0x1f, 0x6, 0x0, 0x0, 0x4, @perf_config_ext, 0x800, 0x9, 0x1, 0x0, 0x5b0, 0xdfdf, 0x2}, 0x0, 0xf, 0xffffffffffffffff, 0x8) socketpair(0x1d, 0x7, 0x6, 0x0) sendmsg$kcm(r2, &(0x7f0000001540)={&(0x7f0000000080)=@nfc_llcp={0x27, 0x1, 0x0, 0x0, 0x4, 0x4, "be4beacbf2779a300e63a0f47391a8a96450ba7f5c9bf868f7c1328aaecbd8fd0751952b3ea76a30a3970100d54821cc65d345f60cac429bae69a1d77772a1"}, 0x80, 0x0}, 0x20000000) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89a1, &(0x7f0000001580)='&@[\x00') openat$cgroup_ro(r0, &(0x7f0000000280)='pids.events\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x6, 0x2, 0x3, 0x0, 0x8, 0x81000, 0xc, 0x1, 0x1f, 0x1, 0x5, 0x0, 0x33, 0x5, 0x3f, 0x4f0, 0x0, 0x1, 0x1, 0x3, 0x20, 0x7ff, 0x3, 0xffffffff, 0xef59, 0x4, 0x1ff, 0x0, 0xfffffffffffffff7, 0x0, 0x55, 0xd0cc, 0x7, 0x80000001, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x58, 0x1ff, 0x0, 0xd, 0x0, 0x43, 0x8}, 0xffffffffffffffff, 0x10, r1, 0x0) perf_event_open$cgroup(0x0, r2, 0x6, r4, 0x0) 02:23:36 executing program 1: socketpair$unix(0x1, 0x800000000000003, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg(r1, &(0x7f0000000080)={&(0x7f0000000000)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) [ 443.602026] binder: 23018:23020 ioctl 40046207 0 returned -16 [ 443.603462] binder_alloc: 23018: binder_alloc_buf, no vma [ 443.693855] raw_sendmsg: syz-executor.0 forgot to set AF_INET. Fix it! 02:23:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000020000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:36 executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) pipe(0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCLINUX5(r0, 0x541b, &(0x7f0000000180)) 02:23:36 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:36 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x4, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB="bf16000000000000b70700000100e0dd2800000000000000bf700000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x1bd5c7]}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x0, 0xe, 0x0, &(0x7f00000001c0)="3c6f35550ec6f63b04d2668e0580", 0x0, 0xf59}, 0x28) 02:23:36 executing program 0: 02:23:36 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:36 executing program 1: r0 = socket$kcm(0x10, 0x1000000000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000100)="2300000052008152915a655067d7aee4050c0000136017edcaa30000000000008b1832", 0x23}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r0, &(0x7f0000000cc0)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) 02:23:36 executing program 0: perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xffffffff00000001, 0x8, 0x2}, 0x2f) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0xca) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r0, &(0x7f0000000080)='h', 0x0}, 0x18) [ 443.869819] binder_alloc: 23065: binder_alloc_buf size 4893816 failed, no address space [ 443.890202] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:36 executing program 3: perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xffffffff00000001, 0x8, 0x2}, 0x2f) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0xca) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000002c0)={r0, &(0x7f0000000080)='h', 0x0}, 0x18) 02:23:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:37 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 443.995527] binder_alloc: binder_alloc_mmap_handler: 23065 20a00000-20e00000 already mapped failed -16 [ 444.030324] binder: BINDER_SET_CONTEXT_MGR already set [ 444.112058] binder: 23065:23073 ioctl 40046207 0 returned -16 [ 444.151566] binder_transaction: 7 callbacks suppressed 02:23:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000030000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:37 executing program 0: perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xffffffff00000001, 0x8, 0x2}, 0x2f) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0xca) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r0, &(0x7f0000000200), 0x0}, 0x18) 02:23:37 executing program 1: socket$kcm(0x2, 0x40000000000005, 0x0) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000180)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000000200)}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000f00)) socketpair(0x80000000001, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000300)='0\x00') 02:23:37 executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) pipe(0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCLINUX5(r0, 0x541b, &(0x7f0000000180)) 02:23:37 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:37 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 444.151586] binder: 23065:23095 transaction failed 29189/-22, size 4893815-0 line 2896 [ 444.241655] binder_alloc: 23109: binder_alloc_buf size 4893816 failed, no address space 02:23:37 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:37 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) read(r0, &(0x7f0000000040)=""/11, 0x7) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000180)) syz_execute_func(&(0x7f00000000c0)="3666440f9bf56664400f9f3241c3c4e2c9975842660f38159d000000003e0f1158101019c60e345f5f04cd0f2902") 02:23:37 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 444.286023] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:37 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x3b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x4000054, 0x0) 02:23:37 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) read(r0, &(0x7f0000000040)=""/11, 0x7) ioctl$sock_SIOCGIFCONF(r1, 0x8912, 0x0) syz_execute_func(&(0x7f00000000c0)="3666440f9bf56664400f9f3241c3c4e2c9975842660f38159d000000003e0f1158101019c60e345f5f04cd0f2902") [ 444.334661] binder: 23109:23111 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:37 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 444.400553] binder_alloc: binder_alloc_mmap_handler: 23109 20a00000-20e00000 already mapped failed -16 [ 444.420133] binder: BINDER_SET_CONTEXT_MGR already set [ 444.428730] binder: 23109:23111 ioctl 40046207 0 returned -16 02:23:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000040000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:37 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:37 executing program 0: semctl$IPC_STAT(0x0, 0x0, 0x2, &(0x7f0000000000)=""/131) 02:23:37 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 444.451183] binder_alloc: 23109: binder_alloc_buf, no vma [ 444.475967] binder: 23109:23134 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:37 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:37 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) [ 444.582088] binder_alloc: 23150: binder_alloc_buf size 4893816 failed, no address space [ 444.599249] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 444.612311] binder: 23150:23151 transaction failed 29201/-28, size 4893815-0 line 3035 [ 444.681410] binder_alloc: binder_alloc_mmap_handler: 23150 20a00000-20e00000 already mapped failed -16 [ 444.717385] binder: BINDER_SET_CONTEXT_MGR already set [ 444.732627] binder: 23150:23151 ioctl 40046207 0 returned -16 [ 444.745215] binder_alloc: 23150: binder_alloc_buf, no vma [ 444.762188] binder: 23150:23159 transaction failed 29189/-3, size 4893815-0 line 3035 [ 444.771549] binder_release_work: 8 callbacks suppressed [ 444.771556] binder: undelivered TRANSACTION_ERROR: 29201 [ 444.786333] binder: undelivered TRANSACTION_ERROR: 29189 02:23:38 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:38 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:38 executing program 1: r0 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) close(r1) getsockname$inet(r0, &(0x7f0000000200)={0x2, 0x0, @remote}, &(0x7f0000000280)=0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) prctl$PR_SET_ENDIAN(0x14, 0x0) dup2(r2, r1) 02:23:38 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0x7) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f000000d000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 02:23:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000050000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:38 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 445.265501] binder_alloc: 23179: binder_alloc_buf size 4893816 failed, no address space 02:23:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000440)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000940)="585ccbc4ed83b836c1a6474914dc5500b66147b3c7218a91690000000042e3d35228f94d1cef9f7830897501f93191b076ac446ff0022b8753a1fa748c569f435fb3eb6f6efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637ce0080b4ec24c53d86571ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff33c1e8e036e5031949762d009d308bd73f47725390000000000000000000000000000000000000000000000195e230000000000000000000000009c237b00adedcde0f3d63a8b08000000000000000c39ad2ce88a86d0833e9d6ce82b8dad68d586c7a60383485c570305ea77edaa97f44d960af67eaee3485846203739bc89c6223b3e8196fc309a9134094dc3f9af9dda65e0c05e8cd299d4f47657e93aca75120941ac2027a141a82dc6ce56caa6b161551e52ca1aae9e8b2e469b7cfd29b2f7366d3a0aa9b5973fb9b10d3ed3b6f3c9638138093bf8a19a31a959e936e8c5b687b605ef6543fd828516252cdbb27584121d5a425ba2e7da326c9cf67348afae27f4e4feccd5874eb9f5d896a2d1b357f0ade7b480bad592ccb2958d74f74e3e091e6c64dabc1b78627170abc9b768dd4446cae990382a43e394a8741d96b9e736513e50eb4383ad97cb025ae302ece193aa5f8703555e4eb17a60f203b863aa187024fa0199fbe7e1a56ef48ec20dab36d850", 0x20d, r0) r2 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r2, r1, r2}, &(0x7f0000000700)=""/243, 0x356, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x0f\x00@\x00\x00\x01\x00'}, &(0x7f0000000180)}) 02:23:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 445.323368] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 445.352585] binder: 23179:23180 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:38 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 445.426618] binder_alloc: binder_alloc_mmap_handler: 23179 20a00000-20e00000 already mapped failed -16 02:23:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000180)={@remote}, 0x14) [ 445.499506] binder: BINDER_SET_CONTEXT_MGR already set [ 445.588207] binder: 23179:23180 ioctl 40046207 0 returned -16 [ 445.629385] binder_alloc: 23179: binder_alloc_buf, no vma [ 445.655111] binder: 23179:23215 transaction failed 29189/-3, size 4893815-0 line 3035 [ 445.663730] binder: undelivered TRANSACTION_ERROR: 29201 [ 445.670020] binder: undelivered TRANSACTION_ERROR: 29189 02:23:38 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:38 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000040), 0x0) ioctl(r0, 0xfffffbfffff3ffa7, &(0x7f0000000140)) 02:23:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:38 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:38 executing program 1: 02:23:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000060000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:38 executing program 1: [ 445.751986] binder_alloc: 23222: binder_alloc_buf size 4893816 failed, no address space [ 445.769774] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:38 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 445.807761] binder: 23222:23225 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:38 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:38 executing program 1: 02:23:38 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0", 0x8) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 445.912388] binder_alloc: binder_alloc_mmap_handler: 23222 20a00000-20e00000 already mapped failed -16 [ 445.950048] binder_alloc: 23222: binder_alloc_buf, no vma [ 445.950650] binder: BINDER_SET_CONTEXT_MGR already set [ 446.008211] binder: 23222:23225 ioctl 40046207 0 returned -16 [ 446.013361] binder: undelivered TRANSACTION_ERROR: 29201 [ 446.019890] binder: 23222:23240 transaction failed 29189/-3, size 4893815-0 line 3035 [ 446.048765] binder: undelivered TRANSACTION_ERROR: 29189 02:23:39 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000040), 0x0) ioctl(r0, 0xfffffbfffff3ffa7, &(0x7f0000000140)) 02:23:39 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:39 executing program 1: 02:23:39 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0", 0x8) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000070000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:39 executing program 1: [ 446.283730] binder_alloc: 23259: binder_alloc_buf size 4893816 failed, no address space 02:23:39 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:39 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000040), 0x0) ioctl(r0, 0xfffffbfffff3ffa7, &(0x7f0000000140)) [ 446.324911] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 446.352071] binder: 23259:23260 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:39 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0", 0x8) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:39 executing program 1: [ 446.388256] binder_alloc: binder_alloc_mmap_handler: 23259 20a00000-20e00000 already mapped failed -16 [ 446.479904] binder: BINDER_SET_CONTEXT_MGR already set [ 446.485787] binder: 23259:23260 ioctl 40046207 0 returned -16 [ 446.499157] binder_alloc: 23259: binder_alloc_buf, no vma [ 446.518203] binder: undelivered TRANSACTION_ERROR: 29201 02:23:39 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 446.525166] binder: undelivered TRANSACTION_ERROR: 29189 02:23:39 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0xffffffffffffff26, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) r0 = syz_open_procfs(0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, 0x0, 0x2d0) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/144, 0x90}], 0x1) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000000)={0x2, r0}) 02:23:39 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) add_key(&(0x7f0000000180)='id_legacy\x00', 0x0, &(0x7f0000000900)="3c373165105946b830309eb8a473c2206adb1686bc021a1745d2a6362299fdc7c7775b672d5be4835b7056734690028bddcba35b453e845e4e7141396fdd027ef92f27a8a77b771098dea3d338491df764d68b5fbcc33439ffb77b92f81b9bd009bf7a240e43b1d0307751ba302c418c6f5783ca36b283ad7ba9c176", 0x7c, 0xfffffffffffffff9) getgid() setxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)='y\x00', 0x2, 0x3) add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e53859ab66e5a7a138734b4777a1", 0x34, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r5 = request_key(0x0, &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000400)={&(0x7f00000001c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) mkdirat$cgroup(r4, &(0x7f0000000240)='syz1\x00', 0x1ff) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(r4, &(0x7f0000000000)='./file0\x00', r4, &(0x7f0000000100)='./file0\x00', 0x1400) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f00000010c0)={'filter\x00', 0xbf2, "69d3713904c22c1d329ceb56d8a725939535712c93062efab07ccdaec656b663f5591ed5f0198e3becea8c7c6b1215a38d35109f79503827f73371219339aa28b8dc13428b24af2763efcc137e9c0457d10f7a497657b1975492a4729c9f4c40003142098601e979b20fd9ce56c82b95f17c9ff5072b5dc761109e5d90b12cf839d3de038d3aa9e8a73db1b773f376ec943c269ad2a65451c842c64e47f645c37188375a77ab07408cc1f6eb6aa693b3df527c56a6b93b3d522e4196a59c51e7cf5da4d754ad9338080cc33c8cc291d594f49bf0a2d48437bfa34b99e8b73f93c06b314bc2263b164741d10a964cda633297e6a28024c1c1fe8f1565dfb2031614c642746748f01c5ab2baaffbc7ec24c814f0e4ad3591145cb35951957c659e8d8241761d7bef600eacb2db029ff9ff95364e438313211386688bb3b2b6fb054d6f225eb4a8813d3fed880ecb552fd93cee9fe816f88f188e571ee4c1b594f2961c7a53086da38ccc3bbe528127e81f5f739b22836f9256a61e8c83b3a438c89c74684d1af2e7c2f3b5cb3d51d22ee5086517334456a137bca584e189feefaa2cfbd211d33668fe17963e9c02cd5776b7ced2cfcab7012b15220b95e95ca9c819c76dbdc34459674f1b4e2b25055dc018cadea56e77be469d82b38010588bc9aa3624a341b6c5842a0fce83f986650740e0e93d0ae2da7b684b9b1465e1667c70a1a1a6aa5880c6ce6b19aca8517c24abff7c7b3e99e045c62a9df3ad67ae810dc93316b69500d7205b7b937774f324938da53704667aa2ecf3854cbfba961186cf395a14b2ddcd5984a9ea3b4c189c2ee01f43bf26b972f739f201836f3a98acae28a3aa4216c1b57aadf78ce6482a2708480d593667530999ea85a8388add797e498b3c11ab7e40339af895c848c6feac14e29e521adef564d65e77fbfbe6c21ca8a257f47e042689b9027d8e56c0baa644496985cdbd90bc08db3c4f0e58a8fad759d1b431b33aeff1615e15f19b45b8bc74e9200bba77ee79dedc51fe9793f7cd6cdf185f66834f39267487442006d0d0f64996078dc6f05e157a3e49d790783a61e91222663c5f3706bbf89546ceecf84760e596d3f50f01bf49fa394b814fd7d128d1d1e951896729b53e3c4376a9bad5ea3bcdbf7a6cf4644ab708b490c4d8685e3f7cc1e4bdfd1b98991dc9a86d72b97fd573db5d6fea899c3e622d637054868caf431425b1e8edc9709302ad9d92d5d93c5672750ecb4273f185d5ac697f6588499775ffbb74ec25a1382013c7c1cd9f5d2531e6cce64daf91ce9535210bc88a1f9059cb7e73a2b4a7d537d56104be9ae70c0d5c456d7ab71281eddd34fa4db60d129af84f0e8a02246f6ecb431d5bc9630ad8d1c672a50697de8e0fad06d766d0e2fe70432ccab10a3606fcaa2a12c2814f1c0c0730c3256331711cd8e2a32cb2941f24058d60e3d2b501a563480519ea3d388948f5216265c1ae0e3caabb8cba4de6ee433a26c5a6ba521560f54548e7176f6b050a77814108e6799a4cfb8bafc0f7cf48f0edeab0be49947902e34a38bbe50d7fd263fdff158d6b4a141c12ff9c4147761c92db19630e2de0ec921f6df5093fc2a5955478f1a1cce0b3496bd91377cdf0a143b76616186251a184cc03eb8369850733a6bcb3bef04d22d57f7c2b7eb690b6229ac82efd765464caee43928792bd80f712ee4081e6fd05af00b1a8c287093cf961003ca8f5254254841e601b33e2d5b7c28d02e9ec15ce596d75e14b0c6cbf086e4e5ddd3b2390a42a80aed86346a1a4c6acf1f822a44d8206418676a5c50aae527b24ec1861214c29fa6f25db2ce0c9b0f12a5dfb7dbc19b94a9d77277aaa533654000767cab093dc9874c5d468221778c33d4e49e3ccd55da84e9bbea42b7ffec6620eb749909692933d86e72d5e6a2c34874fc1cfdaebf56c9ff74444858d5c9245e47a63927402a8d391514936658c1465e45e04b11564f1564693a6ec5bd491bb674a86b69d8438998ee3c154ecfabf1aa6dd3bba00c448c4cf4167a1a0cdc4855c2b6206a2abf25888eda11a5360fcf5916dcadbf07a3258b7397bab4a67a6f1ed1e78d2deeb57231dd0524cafebe6d6e812758bcb9e1c9460d7a7cffa58faae16b0ade26eb792a7c818f2b96e9a3ce493fe47ec1ac4bada7a57d6e9564b9be4c65a2663e869134ee2bb1340c1c1d368022112aed7593b946874eab7e3ee205ff6a119d8857dc4236f3e9920b0eb15e20fb46ea21763bf97e5080132d322aeca3af874f58f56acc55aa2ef6850e330377ee799edbd4826b2618c758e413ce2352cb309d4f4d632a4283f3965e8f21e415321241f1e2e4f8ec2d58c70fb0b47667a455349fafc7b60c14c9e1e6e9cdd7834019782424d442f68d6d3af3f9cb908af1fdf1f04397f2ed24f14ca9fa0e351f1a63f7e19a147349fff0a33f56cc30b2271595dfb5d6f3c977ade1100c25847becdd2c13db8ffcef10e7296031601fe383ab3f957ce89a0fde6dfdb76b60cb89e63d38261eae2115d59cf155336c83a5ae86211db5e56416c38d7cefc458b1dcac45fd6639912d5d5ecf80da1c1fd7c5e27646732f5ba56c84b4aa17971f0094b0b707246fb5f102fdbfda28eff48f21e334513cc981298fa2caaa5f88013a7ecdf46f6fcd0dc226a1fad9ebacc081d4fdf08e516b8b74c8e8e6d3e3e32674031a96f238e3f74a9cca3ea8d9c3cf225a91ed1b7fbb6a314632af8a3e8be4995b05e1228a6a24a161f66771d1d34feec2f7d922d14d58bcb1795343edc732309c97efacb1470d8767217d5a12732e6c8cb5438b481c175d985e8356fc009d1a86927236ec1ecb4b6cf3d6639e5917dc0924584704676528db1b3635e90c331a7db74f4b3bda09359e164877fa83a3c68e4016a752d54426afffe732276502b59a725c3538c0db60e7ae8e32235a237783c43973ec1babd30a62839a8f88797e68ed3b32f054f891a2e6f1a44fa731f06baf8eede29d8a2272822956b3ccbe4dbf0651f5fd786728cefd11500f09465da0113422e600f1ebfde7e5f6e5f8d350a3e628de03f524d20c17845502d5f925de14b82f5a05362e3e866c39a78b11f02da18c0e81bba4d881d645cccc59788838e2453a17f5367a4b90ecfc8004e6b7cd3c86a4f763b88ed588c23767bbea94fbcd353efa1471500b6ac7cbd94457339e9f07357e3d05037af1258307a08704ceebc701d6b3d4c76026d5cd4d6c309b1c129c7c6be8ba5ba648562a3fa49cbe0c7bb94f9ec3dce65a9f62e261f8c8b2d0e248083177589e1690932688f395b4ecb0183beb1fc494d8859f9e4e48eeaf5460e05d5f7c189ae3e18be3cbefa86d02142cd0bfd8fef87010d4a91fb062cbe698e7b50c90be90081f737e9a204053fc35377fbbd2ec7dfc4c79f12457cb1309e61eaa6c773e5f4abd78b01305d099332a2c9c0d6f9a9156b0b19bfc21d68de6952bdc8f0ff6391bee508519ac0a33d361f2b8d802d5248b5c709554cd93e7562d41b4f725c76d2c466ad8995086bbb5cdcae81072e87177bc5ca62a9e2fedbf92cf7e22e15f1e1a3a03919f9876a1d58baa76f0d87e5b461a7b540efc39d20aa00e517c0b5546bdd7a8b7a08d4af382e5457dc9c4957bc5099c43f161e53955fc286a86ac5b3417c7f9855590554578247d801458c4e0fca9f78f37260e2c576ee7045ab66b2198bee93df75614e7d3aca7f4b4b494f3b61a2774f00efa1624516f58bac90e9d1eb898cf3cb386e11bfd303a9a50b76e8fff419ad39ce5ead6487a70308743c42c7a8e9d5b47cf4ed73359fab6185a38b1ce47f8388c8439867e5d1ce106014d785864f1333e12422d65730e7a093278bb45351451c7e9c93a2567e0313f2b9421acac8faeab2b33f89a5037c5f901b555024d50c17ca13aa1de9bcedd3554e498fc116f7c13b3fe0267b22983590f8d947673bb1ca198a443519a3c32a5b100218be737bd778472c45fea1656a285a0e7aac438cc87451820199a3cd182536b048740f3ffdc06e0f69b2b127ef7fc56aedf93c2c9bcc3f3d47f69ebcd195c4fe2122cff3fbe3add182e60cdb83f8dcb587e8c269a27f1210a602913dd7f004b3c1c4457298cbd0691dd90fe2c87bf693c71ab0ac7f57657d353f571b1f2eede0f2315da9e7951c2aaee84658ff52c2c59cc08ccd639f723bfb790b976dea33e2a4db213e7d0e9965da35f1cf5effe715e4d0174b1a60a08eb152a7f9f38a93a883eb3cf34a22bd60e71a513c31dbd27e0ab9dc0d779be252a1734bcbef4485c72cdb250669215e454de7aa"}, 0x0) fdatasync(r3) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000480)={r5, 0xd759, 0x2}, &(0x7f00000004c0)={'enc=', 'raw', ' hash=', {'tgr160\x00'}}, &(0x7f0000001d00)="3f1780a9ee30ec7d00438973e50b1db9f4fac3877f00855d029e6602c2c65cee85905945d5291ef6fe533c4730d2a8cd0a124970ad2040d9bb172ff52e7c6551904d6215ddace3d47a060d17786198e3794705084e50d5b897adf518cefd07f3dfb665a919ab3e359574bc84b4eed89b3cb68d423b3b96eed7600060202946d0a251ff6ae25b814dcb88c8d3515e24054cdb25750956d20755366ecf16444cecc08e75a30b302ee1061f6ca448f7ea5f3bb3e53827af50db13bf8d36b90b8bfb8ec12d636bd0139c7d2de5133509309cee2782151182ddda65af30abad24aa963240a713e62fc55c71002cd7423ac770d896708b2ebfed1988fb7ffedc12919111f09364108cd2217bc819b25d9ea051efa1e05950cf8c621b127dc6ab4009cdbda6d561113f1c07d47e8fe3d061e3414988c6cc443299c591383c5b3ae2cd3412561e69c213317266916863489cf59e702b5c48dc7e0373dadee104f29a760429f8b9e1a8df31bab81a6d815f552caa361a4be9cc0b21ac8ea264a090478128bfd66036569a2dd84b9a50bf64bdd9432d666ea161b0581ed3a76abc7a1b4c729b82865d055d72fb486fadf26016f7eb49c1d881b0605d10a90fd5d66a6ea1d6532e414c644d1b8d45fdd682d4015d7c133a290bf2e1fce4566cd7267a43793c7d5943b0d72d876fb84c344b65f75e9763b7cf67184aa5edbdba5b84faafb8f2d07b444afa5ab5caecddff3615324609e64b3d45994f119875338fc44f87227e0a36b1a6e727ff54a283789c09a594b2091ddaf91186954a796ff99023af488f5a815e9856835a0c3c2417de388c9b96c186b583dea6a6ac9b4ef66c19450535b6f0d54a79c8fc03b66351c71010536afeec7f39e12d3d33581f1d3047bc43b23a8f5f2013eb011fffcaea957338158c3b08470d579774e9ef7a8f7e3cc90f6a91907b4b4d4485d224e1bee31e13ffc6baa18ad4aeda1509a93e887bf06709d6a2af6af22def96f385659389c44209dd8de0707c88fa3cf3ee455ef6ab1bd2ffce13a40b67732ec76c1f3f28859e49c517a3cf4d07a934dca5271c4a8fb1e41e26d95adb98462bab0d2a5fa47be50ef4a6b6b46bfa4a36c98a7a14b842a02ed4ca13aea915adeb8ec55b46c4ce802310a58d4bc329c5016503d32e25c0b33bc6f3b131c028d6e2074aa6463ccaeb202125cb0c8d57439ce308bb23f3f1ca1dad8654ebc610b1c72175b501530bb997f5d7964a2619052b1715342afd0719de1011d44d9179fe3512b2e703ed912afd8d3a005ba353acb092573c262578416c27e359720a208809da7b58ded71b32687f96edd857ca50b85fb006e5b17d941728bf748232b4df94cd2416c0e8d11d113ff0ed9837fd4e9b2495ea0623d1466bc8b4ed16c717b6d2878d3e05c2b4855f00663cb505bcbf92026fd7dcba44d211e4479e01d4aa79a57d4c521a7c60879d2ee0fe5b0a3cf557d5bbe200c9121cbb6122e70219b816d87bc660fce8baa01d420ef41fa08a129142fb9c82c10847bda16ae93e23f0b035bab1381f941d1e4a9f7ec318490bcec4a0c2a52a41eb83ddf19c691506e80c0d89c007f2382537d303f8c49a841521493d55057a51db2d37a12c893c324d185ace9b8dd033a29ccbe72eebce5f180f48af81ac78269dd9b9570f9899b226adb8ecb76f1a5fb113d82dad98dd51b0c735a52872c5f71d20671e706b375220c7546fc202cef5c1d1ff16143eae6460f113edec414607a414cf4ccf500eab22ff6e9bef7f807a5ce7d2a6d1fcfb6d5e8ca0c2011cbd418bc3eff090e188024a4192b6e32dbaface4399cc85d273afaebf824fbcd4ce0ae3695e3fdd4af188f9d2e9dc3a4e6cc40c1cfa494293648b13f509c6c12457a7048ca0eb56b3008614b8dafd613bc40760510dd444393645cd258cdae1cd82af45013d7078d99eb08f377ad2ca214aa527fa7783a751d510511ed59703d4c034d9540c9e17a66db03201b00e989cc948d1fe3edd2f784c65f74f7d5ea1cab390e6de63be995facf735fa169255c7e84211bdfadf231c25f1f6c391c0a8db620b2acec15e82995fed0278e9aa5a2ac5d0b1b4163fb4ba9151584bde6aa3ec00d50ea0e210eb62d027629504c5d5ef2ed732a1a20a4d2af46158d292c6d716a4f8bbc80eb60043061cf668661b1ae0f4d873f44286dd6938525303a043bdc8df388fe66b58400804278e428da7657cbc9f28f5a94e2d7681eed795f67ec740723e0b77e5ae36585a7b41e67c9705c6e70b2d638c06280bb9bd46a6bb49d53df509da72355573460de0be72a3d82dfb49e236e32f1d6fd3e4dba6e60c36b5cbeb5dc2e35b9a6aaa6a8e2629999cf800bd7ad5f7971b933647f8c3c343abab1b5dd1908ea0a8c66d9b3d152c092f96c05ed0af317de182b2a8b7c5fa9bd9387f09d3c6efaf974839230dfd034d51c89a148843fed2b9231c1e740f4cb63eafd47ba0fee95642c8f1ecdf6ab2197af87320a272d98710fcb9c1e837aa4485714d16cbb1ecf9b1a3e6dd1b0f10bf4935f175560c93f6bc4fdd94b7e32b0d8f8de0d711f8db12b2f215bb5819a87263468bbda10a8efc8097ee6d6519a1307ae8ac8460b4f741789f3b22a4ee4630e6fe47bacf25dd1eb6aa32c6b908e1a97eb4c20773ce1d531de7b00e03ffd85d9e779038c34c733ebb27e6f5bb9f41c160adfc062d4c94220d68605cddad8fc346852190f779bc2c9d2ece357e8330f05ac14fa8c10775e2edce93bd5cb19dc1a5e77022bd229e63e4e2fcb26862a207ebfc196fa3d2eca2f6bb206337ee40cc66fa832530ce3e7257e81e49742cd39b512688cfeddc4f9de95f91cc5076bf5b4fda791d4c9f3cc685ba1457e32ee710bb44ac040781d598216fa8b0f7e34e3d9a4d5a902889abcb1dcec9d7d3dfa0d1672497fda024cdf27856aecb9730ccd668b953b088c50f1ac76c836613a4f81215504661cc41ec9fe8e26716d0fa1d67056a1783b60256018ea3949d7a77800c07fca340769734941efab14ebc216ffdc45ea89a7b6711a33186200261079f1c1a6657c9c7a9b7cb7ec42c0e84fe2de927dd699b2e22f5e35083e94f3373a40e8a87f7609b6f5f6b63f6894a776500c7f521a85ad524947b0bf8875003026ce796e3dc79fd2f58f3d72befdc71da067b35e745fba687020912c99ffb091efb768132e5e0e81329d8dd0152ac709ec6709451e403a4e4736b3020a78a8f13ba6b066a384baddb3fe58df255526c103816a77ca27cb339ffb71ad3176076f17f27761a562e561738431356f1d6d5d72cf29a023820419ef78616947423dae3e60b863d34f4ae721c51e3b85863d0c6be720a8970e8d3a6c8fd9ba1a4504e7b3fa3d95380e335a2fb08a57480afac8b36c941f972fa4c098ef1e3fc8f6932e72efe8ba436ba92567ac4954742791c0a790362a624f8d356a637636d319127262fa7d1d361ca5026636d838ba68e3d79a38a0dd241c785798d151695bc4253590e7f7bb7281b29f278b163bb078b4fdc600a5f271ca0c5706e141bbd20ab7cb39c662831ee72483ba90f7173267da999e141fca3c2dc59a43fc707ac37d130a08e2131e3f9a50b19c76139c3dd033b2dd55f52768df66d4b3f24c789a5beb40f182413c0ec464f9fdbf5723b364f4fb7bee522f93f86fc948a8f2b31a06503a9737d1823d126fc903be1e6a761c4999a3e36e5ff5a8193eb38a10cf70f3c92b8d77ab7b68d786aa83eea6c44519b339cb9d9f033e4a96ce16d18d66e4c548e4d5d9eeed9f7121f1afc064791c7269afebe96b8de55bf80a271413119ad561e151c8f54a807f139c0f58e1aca84028c458d3411e95718cca728f11017292005bd86aa87b112b75fba0dac10c8e47863c256d2de2451a4833b96aa3784be6892eff87a71b6f0e34a7d3cecd847cca5a9aa9cc34491cc1d943d1efa935bc259f04da86bc8f4035d4cb810a2be90f7af3630678442da3ecfca9f95d25ac114e006a8156b432fef8a26c63f164fb7661699bb8a4d0c59bc93cd51a8eebf1137406d4a2e3f1807d92799266d67917ede1004c91907cefd26750b70fb6b018e31f0d8530645a01e4b085dd2d1c59362497c4dcbcf7ef75a3340b1695f59be84a5c78db3c42ff346613bc0a524816fc845212bba3ff7a027f938b116a1129bbbb5a20a810944d3edd203319cf354fa8a7c7e1cdd882718c491da9702bd9130be1bd27dcbe8668892cc8cbbc8b0cd6590c6d5ac3b87c8a3f9ab5ec1edabf0a99f32166092c1e17715dee4fbfdff2bf17afeda720cf35a2196aec339f1b5a05a0ad9f3cbd8516d96a65b1d43f8aaa28639e900d393d8b63d0abb89d7dace26377ad34a0844b0e33b6bf667c14350f98e614c64bd66b274935fd0b5fb94da5ad47062e3c93522b27efacc04ce77611a61e58ee0da4e8c2ae2dae433ccd9ee7514c9500eb092ea4beac8a2328fd3d2352fdf916d1eadb358bb2d15b9549cf7984f3820fe8c65efe23fe3a183e08c5fd194f5d3f47e4b99e62933cd5ed04a3550b30f2d48ca9e38581a714ef6c8ecf887bafc7f4e3d49b7ef442e6f66ef6a3d004c0ac60f37f3573fdea63dfb83d6ec2ad6815a4f6f36a5d99a6d3b396d28e1873bb2e5552209d976a19a0cca78bdf3f38271c6cc151f2979c0ccd45e866c3e30459fd01cf08f9b47032887e8842f80cf6ade0c6539580d6357eebe28c46ce9bbb9af5aeebd593d60684fc21a43e486dfee1cf3370c5e178e078d0f79a358ed887e4ccadf54b5e1242b83431a323881b3a2a0150c8d65f966444b176041ed72f476233f7e2e83ba551ee53830ecdd7bac050b78863f18172c2629976dd125a62cf644c097153319f788abb83b7f93b2464fb54fbaba16b2fb3bfc776ed4897b1fe3cb35403ead8bb1ed035b67843eb2c7cf911f3211e4a6065541e75967c458f915eced57a1438e570e8f36cc39c030d162968614da06724e9a12e6ee65e22faaae7b49e80234669820fca8fcde92aa504f80d3101062007a9d9bd2bde119d08eae3713d04d1e63fd6793cf06fa7ac138bbc11eecf978b7b40c94031fea42c1b08e86b18a3122bf96f5237a79f0743a4f4b8085072a4522e15a13ae8307efd52f7e203254c9cd408ea4e6720a76a283df027c273deb481002bbda477d0ce7d8dcbd7b94e0e4dfd3900ca0685b58ec8ff82e5f2313110739f85fd96e0f0abb03b327d95681caeffb53971c9059b0221f348e43a97dfdc8a8ac575860b3d05aed87b7b29918efdcc931f6080045e635a3dc0471ac108fcbd76d8bd237284073b3c7901f9fd0c4fc2f90cff873772c39fa88d9a7590b05549c4a8523498a6930597f0a83951379c9e9b2323b95c77bc4b4c49f8170c8349b1a90cbed5a784714e25d607dc99eaf48ba1beceb929baad9a18b8a2e865019050ea82bd6f9bf71387a0d4381d155e051b8965b499086f5d76c9732e9d521c1d6fb5a03315ce8a2d1fb760131d5a71004bbc37c66de2741fae258a044ed4773f347015a7844f877b5d3c87ed39917cc878f142a43c2cbad8cb743bbcae1cd39f2432a7ecac82cc742a748a7894ee16d4f67a14821f3b2f4919af2cf1b1062e0e27e03e0a79634b19eaa9d805822fd33deedd42f9a7393eb510d9027ccbe277ee9420e7c0d684232592a19ff44f0db934a20f553c4032305bb1fb9d209a6dee8dc2855b96765449dd266f1cc993f6f3f1e4b24f63d5ec81e1c76a935593d4f292cc525aea9aa6a50f6e39790d5c2af75bf4c08932754dfb6f9dbb2ef", 0x0) 02:23:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000a0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:39 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf", 0xc) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:39 executing program 2: socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:39 executing program 0: 02:23:39 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf", 0xc) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 446.777378] binder_alloc: 23300: binder_alloc_buf size 4893816 failed, no address space [ 446.785772] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:39 executing program 2: socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) 02:23:39 executing program 0: [ 446.850315] binder_alloc: binder_alloc_mmap_handler: 23300 20a00000-20e00000 already mapped failed -16 02:23:39 executing program 0: [ 446.895604] binder: BINDER_SET_CONTEXT_MGR already set [ 446.913102] binder: 23300:23302 ioctl 40046207 0 returned -16 [ 446.934538] binder_alloc: 23300: binder_alloc_buf, no vma 02:23:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000120000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 446.948601] binder: undelivered TRANSACTION_ERROR: 29201 [ 446.955205] binder: undelivered TRANSACTION_ERROR: 29189 02:23:40 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:40 executing program 0: [ 447.116008] binder_alloc: 23316: binder_alloc_buf size 4893816 failed, no address space 02:23:40 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) add_key(&(0x7f0000000180)='id_legacy\x00', 0x0, &(0x7f0000000900)="3c373165105946b830309eb8a473c2206adb1686bc021a1745d2a6362299fdc7c7775b672d5be4835b7056734690028bddcba35b453e845e4e7141396fdd027ef92f27a8a77b771098dea3d338491df764d68b5fbcc33439ffb77b92f81b9bd009bf7a240e43b1d0307751ba302c418c6f5783ca36b283ad7ba9c176", 0x7c, 0xfffffffffffffff9) getgid() setxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)='y\x00', 0x2, 0x3) add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e53859ab66e5a7a138734b4777a1", 0x34, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r5 = request_key(0x0, &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000400)={&(0x7f00000001c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) mkdirat$cgroup(r4, &(0x7f0000000240)='syz1\x00', 0x1ff) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(r4, &(0x7f0000000000)='./file0\x00', r4, &(0x7f0000000100)='./file0\x00', 0x1400) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f00000010c0)={'filter\x00', 0xbf2, "69d3713904c22c1d329ceb56d8a725939535712c93062efab07ccdaec656b663f5591ed5f0198e3becea8c7c6b1215a38d35109f79503827f73371219339aa28b8dc13428b24af2763efcc137e9c0457d10f7a497657b1975492a4729c9f4c40003142098601e979b20fd9ce56c82b95f17c9ff5072b5dc761109e5d90b12cf839d3de038d3aa9e8a73db1b773f376ec943c269ad2a65451c842c64e47f645c37188375a77ab07408cc1f6eb6aa693b3df527c56a6b93b3d522e4196a59c51e7cf5da4d754ad9338080cc33c8cc291d594f49bf0a2d48437bfa34b99e8b73f93c06b314bc2263b164741d10a964cda633297e6a28024c1c1fe8f1565dfb2031614c642746748f01c5ab2baaffbc7ec24c814f0e4ad3591145cb35951957c659e8d8241761d7bef600eacb2db029ff9ff95364e438313211386688bb3b2b6fb054d6f225eb4a8813d3fed880ecb552fd93cee9fe816f88f188e571ee4c1b594f2961c7a53086da38ccc3bbe528127e81f5f739b22836f9256a61e8c83b3a438c89c74684d1af2e7c2f3b5cb3d51d22ee5086517334456a137bca584e189feefaa2cfbd211d33668fe17963e9c02cd5776b7ced2cfcab7012b15220b95e95ca9c819c76dbdc34459674f1b4e2b25055dc018cadea56e77be469d82b38010588bc9aa3624a341b6c5842a0fce83f986650740e0e93d0ae2da7b684b9b1465e1667c70a1a1a6aa5880c6ce6b19aca8517c24abff7c7b3e99e045c62a9df3ad67ae810dc93316b69500d7205b7b937774f324938da53704667aa2ecf3854cbfba961186cf395a14b2ddcd5984a9ea3b4c189c2ee01f43bf26b972f739f201836f3a98acae28a3aa4216c1b57aadf78ce6482a2708480d593667530999ea85a8388add797e498b3c11ab7e40339af895c848c6feac14e29e521adef564d65e77fbfbe6c21ca8a257f47e042689b9027d8e56c0baa644496985cdbd90bc08db3c4f0e58a8fad759d1b431b33aeff1615e15f19b45b8bc74e9200bba77ee79dedc51fe9793f7cd6cdf185f66834f39267487442006d0d0f64996078dc6f05e157a3e49d790783a61e91222663c5f3706bbf89546ceecf84760e596d3f50f01bf49fa394b814fd7d128d1d1e951896729b53e3c4376a9bad5ea3bcdbf7a6cf4644ab708b490c4d8685e3f7cc1e4bdfd1b98991dc9a86d72b97fd573db5d6fea899c3e622d637054868caf431425b1e8edc9709302ad9d92d5d93c5672750ecb4273f185d5ac697f6588499775ffbb74ec25a1382013c7c1cd9f5d2531e6cce64daf91ce9535210bc88a1f9059cb7e73a2b4a7d537d56104be9ae70c0d5c456d7ab71281eddd34fa4db60d129af84f0e8a02246f6ecb431d5bc9630ad8d1c672a50697de8e0fad06d766d0e2fe70432ccab10a3606fcaa2a12c2814f1c0c0730c3256331711cd8e2a32cb2941f24058d60e3d2b501a563480519ea3d388948f5216265c1ae0e3caabb8cba4de6ee433a26c5a6ba521560f54548e7176f6b050a77814108e6799a4cfb8bafc0f7cf48f0edeab0be49947902e34a38bbe50d7fd263fdff158d6b4a141c12ff9c4147761c92db19630e2de0ec921f6df5093fc2a5955478f1a1cce0b3496bd91377cdf0a143b76616186251a184cc03eb8369850733a6bcb3bef04d22d57f7c2b7eb690b6229ac82efd765464caee43928792bd80f712ee4081e6fd05af00b1a8c287093cf961003ca8f5254254841e601b33e2d5b7c28d02e9ec15ce596d75e14b0c6cbf086e4e5ddd3b2390a42a80aed86346a1a4c6acf1f822a44d8206418676a5c50aae527b24ec1861214c29fa6f25db2ce0c9b0f12a5dfb7dbc19b94a9d77277aaa533654000767cab093dc9874c5d468221778c33d4e49e3ccd55da84e9bbea42b7ffec6620eb749909692933d86e72d5e6a2c34874fc1cfdaebf56c9ff74444858d5c9245e47a63927402a8d391514936658c1465e45e04b11564f1564693a6ec5bd491bb674a86b69d8438998ee3c154ecfabf1aa6dd3bba00c448c4cf4167a1a0cdc4855c2b6206a2abf25888eda11a5360fcf5916dcadbf07a3258b7397bab4a67a6f1ed1e78d2deeb57231dd0524cafebe6d6e812758bcb9e1c9460d7a7cffa58faae16b0ade26eb792a7c818f2b96e9a3ce493fe47ec1ac4bada7a57d6e9564b9be4c65a2663e869134ee2bb1340c1c1d368022112aed7593b946874eab7e3ee205ff6a119d8857dc4236f3e9920b0eb15e20fb46ea21763bf97e5080132d322aeca3af874f58f56acc55aa2ef6850e330377ee799edbd4826b2618c758e413ce2352cb309d4f4d632a4283f3965e8f21e415321241f1e2e4f8ec2d58c70fb0b47667a455349fafc7b60c14c9e1e6e9cdd7834019782424d442f68d6d3af3f9cb908af1fdf1f04397f2ed24f14ca9fa0e351f1a63f7e19a147349fff0a33f56cc30b2271595dfb5d6f3c977ade1100c25847becdd2c13db8ffcef10e7296031601fe383ab3f957ce89a0fde6dfdb76b60cb89e63d38261eae2115d59cf155336c83a5ae86211db5e56416c38d7cefc458b1dcac45fd6639912d5d5ecf80da1c1fd7c5e27646732f5ba56c84b4aa17971f0094b0b707246fb5f102fdbfda28eff48f21e334513cc981298fa2caaa5f88013a7ecdf46f6fcd0dc226a1fad9ebacc081d4fdf08e516b8b74c8e8e6d3e3e32674031a96f238e3f74a9cca3ea8d9c3cf225a91ed1b7fbb6a314632af8a3e8be4995b05e1228a6a24a161f66771d1d34feec2f7d922d14d58bcb1795343edc732309c97efacb1470d8767217d5a12732e6c8cb5438b481c175d985e8356fc009d1a86927236ec1ecb4b6cf3d6639e5917dc0924584704676528db1b3635e90c331a7db74f4b3bda09359e164877fa83a3c68e4016a752d54426afffe732276502b59a725c3538c0db60e7ae8e32235a237783c43973ec1babd30a62839a8f88797e68ed3b32f054f891a2e6f1a44fa731f06baf8eede29d8a2272822956b3ccbe4dbf0651f5fd786728cefd11500f09465da0113422e600f1ebfde7e5f6e5f8d350a3e628de03f524d20c17845502d5f925de14b82f5a05362e3e866c39a78b11f02da18c0e81bba4d881d645cccc59788838e2453a17f5367a4b90ecfc8004e6b7cd3c86a4f763b88ed588c23767bbea94fbcd353efa1471500b6ac7cbd94457339e9f07357e3d05037af1258307a08704ceebc701d6b3d4c76026d5cd4d6c309b1c129c7c6be8ba5ba648562a3fa49cbe0c7bb94f9ec3dce65a9f62e261f8c8b2d0e248083177589e1690932688f395b4ecb0183beb1fc494d8859f9e4e48eeaf5460e05d5f7c189ae3e18be3cbefa86d02142cd0bfd8fef87010d4a91fb062cbe698e7b50c90be90081f737e9a204053fc35377fbbd2ec7dfc4c79f12457cb1309e61eaa6c773e5f4abd78b01305d099332a2c9c0d6f9a9156b0b19bfc21d68de6952bdc8f0ff6391bee508519ac0a33d361f2b8d802d5248b5c709554cd93e7562d41b4f725c76d2c466ad8995086bbb5cdcae81072e87177bc5ca62a9e2fedbf92cf7e22e15f1e1a3a03919f9876a1d58baa76f0d87e5b461a7b540efc39d20aa00e517c0b5546bdd7a8b7a08d4af382e5457dc9c4957bc5099c43f161e53955fc286a86ac5b3417c7f9855590554578247d801458c4e0fca9f78f37260e2c576ee7045ab66b2198bee93df75614e7d3aca7f4b4b494f3b61a2774f00efa1624516f58bac90e9d1eb898cf3cb386e11bfd303a9a50b76e8fff419ad39ce5ead6487a70308743c42c7a8e9d5b47cf4ed73359fab6185a38b1ce47f8388c8439867e5d1ce106014d785864f1333e12422d65730e7a093278bb45351451c7e9c93a2567e0313f2b9421acac8faeab2b33f89a5037c5f901b555024d50c17ca13aa1de9bcedd3554e498fc116f7c13b3fe0267b22983590f8d947673bb1ca198a443519a3c32a5b100218be737bd778472c45fea1656a285a0e7aac438cc87451820199a3cd182536b048740f3ffdc06e0f69b2b127ef7fc56aedf93c2c9bcc3f3d47f69ebcd195c4fe2122cff3fbe3add182e60cdb83f8dcb587e8c269a27f1210a602913dd7f004b3c1c4457298cbd0691dd90fe2c87bf693c71ab0ac7f57657d353f571b1f2eede0f2315da9e7951c2aaee84658ff52c2c59cc08ccd639f723bfb790b976dea33e2a4db213e7d0e9965da35f1cf5effe715e4d0174b1a60a08eb152a7f9f38a93a883eb3cf34a22bd60e71a513c31dbd27e0ab9dc0d779be252a1734bcbef4485c72cdb250669215e454de7aa"}, 0x0) fdatasync(r3) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000480)={r5, 0xd759, 0x2}, &(0x7f00000004c0)={'enc=', 'raw', ' hash=', {'tgr160\x00'}}, &(0x7f0000001d00)="3f1780a9ee30ec7d00438973e50b1db9f4fac3877f00855d029e6602c2c65cee85905945d5291ef6fe533c4730d2a8cd0a124970ad2040d9bb172ff52e7c6551904d6215ddace3d47a060d17786198e3794705084e50d5b897adf518cefd07f3dfb665a919ab3e359574bc84b4eed89b3cb68d423b3b96eed7600060202946d0a251ff6ae25b814dcb88c8d3515e24054cdb25750956d20755366ecf16444cecc08e75a30b302ee1061f6ca448f7ea5f3bb3e53827af50db13bf8d36b90b8bfb8ec12d636bd0139c7d2de5133509309cee2782151182ddda65af30abad24aa963240a713e62fc55c71002cd7423ac770d896708b2ebfed1988fb7ffedc12919111f09364108cd2217bc819b25d9ea051efa1e05950cf8c621b127dc6ab4009cdbda6d561113f1c07d47e8fe3d061e3414988c6cc443299c591383c5b3ae2cd3412561e69c213317266916863489cf59e702b5c48dc7e0373dadee104f29a760429f8b9e1a8df31bab81a6d815f552caa361a4be9cc0b21ac8ea264a090478128bfd66036569a2dd84b9a50bf64bdd9432d666ea161b0581ed3a76abc7a1b4c729b82865d055d72fb486fadf26016f7eb49c1d881b0605d10a90fd5d66a6ea1d6532e414c644d1b8d45fdd682d4015d7c133a290bf2e1fce4566cd7267a43793c7d5943b0d72d876fb84c344b65f75e9763b7cf67184aa5edbdba5b84faafb8f2d07b444afa5ab5caecddff3615324609e64b3d45994f119875338fc44f87227e0a36b1a6e727ff54a283789c09a594b2091ddaf91186954a796ff99023af488f5a815e9856835a0c3c2417de388c9b96c186b583dea6a6ac9b4ef66c19450535b6f0d54a79c8fc03b66351c71010536afeec7f39e12d3d33581f1d3047bc43b23a8f5f2013eb011fffcaea957338158c3b08470d579774e9ef7a8f7e3cc90f6a91907b4b4d4485d224e1bee31e13ffc6baa18ad4aeda1509a93e887bf06709d6a2af6af22def96f385659389c44209dd8de0707c88fa3cf3ee455ef6ab1bd2ffce13a40b67732ec76c1f3f28859e49c517a3cf4d07a934dca5271c4a8fb1e41e26d95adb98462bab0d2a5fa47be50ef4a6b6b46bfa4a36c98a7a14b842a02ed4ca13aea915adeb8ec55b46c4ce802310a58d4bc329c5016503d32e25c0b33bc6f3b131c028d6e2074aa6463ccaeb202125cb0c8d57439ce308bb23f3f1ca1dad8654ebc610b1c72175b501530bb997f5d7964a2619052b1715342afd0719de1011d44d9179fe3512b2e703ed912afd8d3a005ba353acb092573c262578416c27e359720a208809da7b58ded71b32687f96edd857ca50b85fb006e5b17d941728bf748232b4df94cd2416c0e8d11d113ff0ed9837fd4e9b2495ea0623d1466bc8b4ed16c717b6d2878d3e05c2b4855f00663cb505bcbf92026fd7dcba44d211e4479e01d4aa79a57d4c521a7c60879d2ee0fe5b0a3cf557d5bbe200c9121cbb6122e70219b816d87bc660fce8baa01d420ef41fa08a129142fb9c82c10847bda16ae93e23f0b035bab1381f941d1e4a9f7ec318490bcec4a0c2a52a41eb83ddf19c691506e80c0d89c007f2382537d303f8c49a841521493d55057a51db2d37a12c893c324d185ace9b8dd033a29ccbe72eebce5f180f48af81ac78269dd9b9570f9899b226adb8ecb76f1a5fb113d82dad98dd51b0c735a52872c5f71d20671e706b375220c7546fc202cef5c1d1ff16143eae6460f113edec414607a414cf4ccf500eab22ff6e9bef7f807a5ce7d2a6d1fcfb6d5e8ca0c2011cbd418bc3eff090e188024a4192b6e32dbaface4399cc85d273afaebf824fbcd4ce0ae3695e3fdd4af188f9d2e9dc3a4e6cc40c1cfa494293648b13f509c6c12457a7048ca0eb56b3008614b8dafd613bc40760510dd444393645cd258cdae1cd82af45013d7078d99eb08f377ad2ca214aa527fa7783a751d510511ed59703d4c034d9540c9e17a66db03201b00e989cc948d1fe3edd2f784c65f74f7d5ea1cab390e6de63be995facf735fa169255c7e84211bdfadf231c25f1f6c391c0a8db620b2acec15e82995fed0278e9aa5a2ac5d0b1b4163fb4ba9151584bde6aa3ec00d50ea0e210eb62d027629504c5d5ef2ed732a1a20a4d2af46158d292c6d716a4f8bbc80eb60043061cf668661b1ae0f4d873f44286dd6938525303a043bdc8df388fe66b58400804278e428da7657cbc9f28f5a94e2d7681eed795f67ec740723e0b77e5ae36585a7b41e67c9705c6e70b2d638c06280bb9bd46a6bb49d53df509da72355573460de0be72a3d82dfb49e236e32f1d6fd3e4dba6e60c36b5cbeb5dc2e35b9a6aaa6a8e2629999cf800bd7ad5f7971b933647f8c3c343abab1b5dd1908ea0a8c66d9b3d152c092f96c05ed0af317de182b2a8b7c5fa9bd9387f09d3c6efaf974839230dfd034d51c89a148843fed2b9231c1e740f4cb63eafd47ba0fee95642c8f1ecdf6ab2197af87320a272d98710fcb9c1e837aa4485714d16cbb1ecf9b1a3e6dd1b0f10bf4935f175560c93f6bc4fdd94b7e32b0d8f8de0d711f8db12b2f215bb5819a87263468bbda10a8efc8097ee6d6519a1307ae8ac8460b4f741789f3b22a4ee4630e6fe47bacf25dd1eb6aa32c6b908e1a97eb4c20773ce1d531de7b00e03ffd85d9e779038c34c733ebb27e6f5bb9f41c160adfc062d4c94220d68605cddad8fc346852190f779bc2c9d2ece357e8330f05ac14fa8c10775e2edce93bd5cb19dc1a5e77022bd229e63e4e2fcb26862a207ebfc196fa3d2eca2f6bb206337ee40cc66fa832530ce3e7257e81e49742cd39b512688cfeddc4f9de95f91cc5076bf5b4fda791d4c9f3cc685ba1457e32ee710bb44ac040781d598216fa8b0f7e34e3d9a4d5a902889abcb1dcec9d7d3dfa0d1672497fda024cdf27856aecb9730ccd668b953b088c50f1ac76c836613a4f81215504661cc41ec9fe8e26716d0fa1d67056a1783b60256018ea3949d7a77800c07fca340769734941efab14ebc216ffdc45ea89a7b6711a33186200261079f1c1a6657c9c7a9b7cb7ec42c0e84fe2de927dd699b2e22f5e35083e94f3373a40e8a87f7609b6f5f6b63f6894a776500c7f521a85ad524947b0bf8875003026ce796e3dc79fd2f58f3d72befdc71da067b35e745fba687020912c99ffb091efb768132e5e0e81329d8dd0152ac709ec6709451e403a4e4736b3020a78a8f13ba6b066a384baddb3fe58df255526c103816a77ca27cb339ffb71ad3176076f17f27761a562e561738431356f1d6d5d72cf29a023820419ef78616947423dae3e60b863d34f4ae721c51e3b85863d0c6be720a8970e8d3a6c8fd9ba1a4504e7b3fa3d95380e335a2fb08a57480afac8b36c941f972fa4c098ef1e3fc8f6932e72efe8ba436ba92567ac4954742791c0a790362a624f8d356a637636d319127262fa7d1d361ca5026636d838ba68e3d79a38a0dd241c785798d151695bc4253590e7f7bb7281b29f278b163bb078b4fdc600a5f271ca0c5706e141bbd20ab7cb39c662831ee72483ba90f7173267da999e141fca3c2dc59a43fc707ac37d130a08e2131e3f9a50b19c76139c3dd033b2dd55f52768df66d4b3f24c789a5beb40f182413c0ec464f9fdbf5723b364f4fb7bee522f93f86fc948a8f2b31a06503a9737d1823d126fc903be1e6a761c4999a3e36e5ff5a8193eb38a10cf70f3c92b8d77ab7b68d786aa83eea6c44519b339cb9d9f033e4a96ce16d18d66e4c548e4d5d9eeed9f7121f1afc064791c7269afebe96b8de55bf80a271413119ad561e151c8f54a807f139c0f58e1aca84028c458d3411e95718cca728f11017292005bd86aa87b112b75fba0dac10c8e47863c256d2de2451a4833b96aa3784be6892eff87a71b6f0e34a7d3cecd847cca5a9aa9cc34491cc1d943d1efa935bc259f04da86bc8f4035d4cb810a2be90f7af3630678442da3ecfca9f95d25ac114e006a8156b432fef8a26c63f164fb7661699bb8a4d0c59bc93cd51a8eebf1137406d4a2e3f1807d92799266d67917ede1004c91907cefd26750b70fb6b018e31f0d8530645a01e4b085dd2d1c59362497c4dcbcf7ef75a3340b1695f59be84a5c78db3c42ff346613bc0a524816fc845212bba3ff7a027f938b116a1129bbbb5a20a810944d3edd203319cf354fa8a7c7e1cdd882718c491da9702bd9130be1bd27dcbe8668892cc8cbbc8b0cd6590c6d5ac3b87c8a3f9ab5ec1edabf0a99f32166092c1e17715dee4fbfdff2bf17afeda720cf35a2196aec339f1b5a05a0ad9f3cbd8516d96a65b1d43f8aaa28639e900d393d8b63d0abb89d7dace26377ad34a0844b0e33b6bf667c14350f98e614c64bd66b274935fd0b5fb94da5ad47062e3c93522b27efacc04ce77611a61e58ee0da4e8c2ae2dae433ccd9ee7514c9500eb092ea4beac8a2328fd3d2352fdf916d1eadb358bb2d15b9549cf7984f3820fe8c65efe23fe3a183e08c5fd194f5d3f47e4b99e62933cd5ed04a3550b30f2d48ca9e38581a714ef6c8ecf887bafc7f4e3d49b7ef442e6f66ef6a3d004c0ac60f37f3573fdea63dfb83d6ec2ad6815a4f6f36a5d99a6d3b396d28e1873bb2e5552209d976a19a0cca78bdf3f38271c6cc151f2979c0ccd45e866c3e30459fd01cf08f9b47032887e8842f80cf6ade0c6539580d6357eebe28c46ce9bbb9af5aeebd593d60684fc21a43e486dfee1cf3370c5e178e078d0f79a358ed887e4ccadf54b5e1242b83431a323881b3a2a0150c8d65f966444b176041ed72f476233f7e2e83ba551ee53830ecdd7bac050b78863f18172c2629976dd125a62cf644c097153319f788abb83b7f93b2464fb54fbaba16b2fb3bfc776ed4897b1fe3cb35403ead8bb1ed035b67843eb2c7cf911f3211e4a6065541e75967c458f915eced57a1438e570e8f36cc39c030d162968614da06724e9a12e6ee65e22faaae7b49e80234669820fca8fcde92aa504f80d3101062007a9d9bd2bde119d08eae3713d04d1e63fd6793cf06fa7ac138bbc11eecf978b7b40c94031fea42c1b08e86b18a3122bf96f5237a79f0743a4f4b8085072a4522e15a13ae8307efd52f7e203254c9cd408ea4e6720a76a283df027c273deb481002bbda477d0ce7d8dcbd7b94e0e4dfd3900ca0685b58ec8ff82e5f2313110739f85fd96e0f0abb03b327d95681caeffb53971c9059b0221f348e43a97dfdc8a8ac575860b3d05aed87b7b29918efdcc931f6080045e635a3dc0471ac108fcbd76d8bd237284073b3c7901f9fd0c4fc2f90cff873772c39fa88d9a7590b05549c4a8523498a6930597f0a83951379c9e9b2323b95c77bc4b4c49f8170c8349b1a90cbed5a784714e25d607dc99eaf48ba1beceb929baad9a18b8a2e865019050ea82bd6f9bf71387a0d4381d155e051b8965b499086f5d76c9732e9d521c1d6fb5a03315ce8a2d1fb760131d5a71004bbc37c66de2741fae258a044ed4773f347015a7844f877b5d3c87ed39917cc878f142a43c2cbad8cb743bbcae1cd39f2432a7ecac82cc742a748a7894ee16d4f67a14821f3b2f4919af2cf1b1062e0e27e03e0a79634b19eaa9d805822fd33deedd42f9a7393eb510d9027ccbe277ee9420e7c0d684232592a19ff44f0db934a20f553c4032305bb1fb9d209a6dee8dc2855b96765449dd266f1cc993f6f3f1e4b24f63d5ec81e1c76a935593d4f292cc525aea9aa6a50f6e39790d5c2af75bf4c08932754dfb6f9dbb2ef", 0x0) 02:23:40 executing program 0: pipe(0x0) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) getpeername(r0, &(0x7f0000000440)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000180)=0x80) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) write(0xffffffffffffffff, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000080)={0x0, 0x0, 0x3400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc9f5}, 0x10) 02:23:40 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf", 0xc) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 447.161763] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:40 executing program 2: socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @broadcast}, 0x10) [ 447.228526] binder_alloc: binder_alloc_mmap_handler: 23316 20a00000-20e00000 already mapped failed -16 02:23:40 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x522000000003, 0x11) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x9}, 0x20) sendmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nl=@unspec={0x0, 0xffffff7f00000000, 0x7e4c, 0x80fe}, 0xfddd, &(0x7f00000001c0), 0x12f}, 0x0) socket$kcm(0x11, 0xa, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000a01000000000000000000009500000000000000"], 0x0, 0x5c0}, 0x48) [ 447.305924] binder: BINDER_SET_CONTEXT_MGR already set [ 447.340014] binder: 23316:23317 ioctl 40046207 0 returned -16 02:23:40 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) add_key(&(0x7f0000000180)='id_legacy\x00', 0x0, &(0x7f0000000900)="3c373165105946b830309eb8a473c2206adb1686bc021a1745d2a6362299fdc7c7775b672d5be4835b7056734690028bddcba35b453e845e4e7141396fdd027ef92f27a8a77b771098dea3d338491df764d68b5fbcc33439ffb77b92f81b9bd009bf7a240e43b1d0307751ba302c418c6f5783ca36b283ad7ba9c176", 0x7c, 0xfffffffffffffff9) getgid() setxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)='y\x00', 0x2, 0x3) add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e53859ab66e5a7a138734b4777a1", 0x34, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r5 = request_key(0x0, &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000400)={&(0x7f00000001c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) mkdirat$cgroup(r4, &(0x7f0000000240)='syz1\x00', 0x1ff) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(r4, &(0x7f0000000000)='./file0\x00', r4, &(0x7f0000000100)='./file0\x00', 0x1400) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f00000010c0)={'filter\x00', 0xbf2, "69d3713904c22c1d329ceb56d8a725939535712c93062efab07ccdaec656b663f5591ed5f0198e3becea8c7c6b1215a38d35109f79503827f73371219339aa28b8dc13428b24af2763efcc137e9c0457d10f7a497657b1975492a4729c9f4c40003142098601e979b20fd9ce56c82b95f17c9ff5072b5dc761109e5d90b12cf839d3de038d3aa9e8a73db1b773f376ec943c269ad2a65451c842c64e47f645c37188375a77ab07408cc1f6eb6aa693b3df527c56a6b93b3d522e4196a59c51e7cf5da4d754ad9338080cc33c8cc291d594f49bf0a2d48437bfa34b99e8b73f93c06b314bc2263b164741d10a964cda633297e6a28024c1c1fe8f1565dfb2031614c642746748f01c5ab2baaffbc7ec24c814f0e4ad3591145cb35951957c659e8d8241761d7bef600eacb2db029ff9ff95364e438313211386688bb3b2b6fb054d6f225eb4a8813d3fed880ecb552fd93cee9fe816f88f188e571ee4c1b594f2961c7a53086da38ccc3bbe528127e81f5f739b22836f9256a61e8c83b3a438c89c74684d1af2e7c2f3b5cb3d51d22ee5086517334456a137bca584e189feefaa2cfbd211d33668fe17963e9c02cd5776b7ced2cfcab7012b15220b95e95ca9c819c76dbdc34459674f1b4e2b25055dc018cadea56e77be469d82b38010588bc9aa3624a341b6c5842a0fce83f986650740e0e93d0ae2da7b684b9b1465e1667c70a1a1a6aa5880c6ce6b19aca8517c24abff7c7b3e99e045c62a9df3ad67ae810dc93316b69500d7205b7b937774f324938da53704667aa2ecf3854cbfba961186cf395a14b2ddcd5984a9ea3b4c189c2ee01f43bf26b972f739f201836f3a98acae28a3aa4216c1b57aadf78ce6482a2708480d593667530999ea85a8388add797e498b3c11ab7e40339af895c848c6feac14e29e521adef564d65e77fbfbe6c21ca8a257f47e042689b9027d8e56c0baa644496985cdbd90bc08db3c4f0e58a8fad759d1b431b33aeff1615e15f19b45b8bc74e9200bba77ee79dedc51fe9793f7cd6cdf185f66834f39267487442006d0d0f64996078dc6f05e157a3e49d790783a61e91222663c5f3706bbf89546ceecf84760e596d3f50f01bf49fa394b814fd7d128d1d1e951896729b53e3c4376a9bad5ea3bcdbf7a6cf4644ab708b490c4d8685e3f7cc1e4bdfd1b98991dc9a86d72b97fd573db5d6fea899c3e622d637054868caf431425b1e8edc9709302ad9d92d5d93c5672750ecb4273f185d5ac697f6588499775ffbb74ec25a1382013c7c1cd9f5d2531e6cce64daf91ce9535210bc88a1f9059cb7e73a2b4a7d537d56104be9ae70c0d5c456d7ab71281eddd34fa4db60d129af84f0e8a02246f6ecb431d5bc9630ad8d1c672a50697de8e0fad06d766d0e2fe70432ccab10a3606fcaa2a12c2814f1c0c0730c3256331711cd8e2a32cb2941f24058d60e3d2b501a563480519ea3d388948f5216265c1ae0e3caabb8cba4de6ee433a26c5a6ba521560f54548e7176f6b050a77814108e6799a4cfb8bafc0f7cf48f0edeab0be49947902e34a38bbe50d7fd263fdff158d6b4a141c12ff9c4147761c92db19630e2de0ec921f6df5093fc2a5955478f1a1cce0b3496bd91377cdf0a143b76616186251a184cc03eb8369850733a6bcb3bef04d22d57f7c2b7eb690b6229ac82efd765464caee43928792bd80f712ee4081e6fd05af00b1a8c287093cf961003ca8f5254254841e601b33e2d5b7c28d02e9ec15ce596d75e14b0c6cbf086e4e5ddd3b2390a42a80aed86346a1a4c6acf1f822a44d8206418676a5c50aae527b24ec1861214c29fa6f25db2ce0c9b0f12a5dfb7dbc19b94a9d77277aaa533654000767cab093dc9874c5d468221778c33d4e49e3ccd55da84e9bbea42b7ffec6620eb749909692933d86e72d5e6a2c34874fc1cfdaebf56c9ff74444858d5c9245e47a63927402a8d391514936658c1465e45e04b11564f1564693a6ec5bd491bb674a86b69d8438998ee3c154ecfabf1aa6dd3bba00c448c4cf4167a1a0cdc4855c2b6206a2abf25888eda11a5360fcf5916dcadbf07a3258b7397bab4a67a6f1ed1e78d2deeb57231dd0524cafebe6d6e812758bcb9e1c9460d7a7cffa58faae16b0ade26eb792a7c818f2b96e9a3ce493fe47ec1ac4bada7a57d6e9564b9be4c65a2663e869134ee2bb1340c1c1d368022112aed7593b946874eab7e3ee205ff6a119d8857dc4236f3e9920b0eb15e20fb46ea21763bf97e5080132d322aeca3af874f58f56acc55aa2ef6850e330377ee799edbd4826b2618c758e413ce2352cb309d4f4d632a4283f3965e8f21e415321241f1e2e4f8ec2d58c70fb0b47667a455349fafc7b60c14c9e1e6e9cdd7834019782424d442f68d6d3af3f9cb908af1fdf1f04397f2ed24f14ca9fa0e351f1a63f7e19a147349fff0a33f56cc30b2271595dfb5d6f3c977ade1100c25847becdd2c13db8ffcef10e7296031601fe383ab3f957ce89a0fde6dfdb76b60cb89e63d38261eae2115d59cf155336c83a5ae86211db5e56416c38d7cefc458b1dcac45fd6639912d5d5ecf80da1c1fd7c5e27646732f5ba56c84b4aa17971f0094b0b707246fb5f102fdbfda28eff48f21e334513cc981298fa2caaa5f88013a7ecdf46f6fcd0dc226a1fad9ebacc081d4fdf08e516b8b74c8e8e6d3e3e32674031a96f238e3f74a9cca3ea8d9c3cf225a91ed1b7fbb6a314632af8a3e8be4995b05e1228a6a24a161f66771d1d34feec2f7d922d14d58bcb1795343edc732309c97efacb1470d8767217d5a12732e6c8cb5438b481c175d985e8356fc009d1a86927236ec1ecb4b6cf3d6639e5917dc0924584704676528db1b3635e90c331a7db74f4b3bda09359e164877fa83a3c68e4016a752d54426afffe732276502b59a725c3538c0db60e7ae8e32235a237783c43973ec1babd30a62839a8f88797e68ed3b32f054f891a2e6f1a44fa731f06baf8eede29d8a2272822956b3ccbe4dbf0651f5fd786728cefd11500f09465da0113422e600f1ebfde7e5f6e5f8d350a3e628de03f524d20c17845502d5f925de14b82f5a05362e3e866c39a78b11f02da18c0e81bba4d881d645cccc59788838e2453a17f5367a4b90ecfc8004e6b7cd3c86a4f763b88ed588c23767bbea94fbcd353efa1471500b6ac7cbd94457339e9f07357e3d05037af1258307a08704ceebc701d6b3d4c76026d5cd4d6c309b1c129c7c6be8ba5ba648562a3fa49cbe0c7bb94f9ec3dce65a9f62e261f8c8b2d0e248083177589e1690932688f395b4ecb0183beb1fc494d8859f9e4e48eeaf5460e05d5f7c189ae3e18be3cbefa86d02142cd0bfd8fef87010d4a91fb062cbe698e7b50c90be90081f737e9a204053fc35377fbbd2ec7dfc4c79f12457cb1309e61eaa6c773e5f4abd78b01305d099332a2c9c0d6f9a9156b0b19bfc21d68de6952bdc8f0ff6391bee508519ac0a33d361f2b8d802d5248b5c709554cd93e7562d41b4f725c76d2c466ad8995086bbb5cdcae81072e87177bc5ca62a9e2fedbf92cf7e22e15f1e1a3a03919f9876a1d58baa76f0d87e5b461a7b540efc39d20aa00e517c0b5546bdd7a8b7a08d4af382e5457dc9c4957bc5099c43f161e53955fc286a86ac5b3417c7f9855590554578247d801458c4e0fca9f78f37260e2c576ee7045ab66b2198bee93df75614e7d3aca7f4b4b494f3b61a2774f00efa1624516f58bac90e9d1eb898cf3cb386e11bfd303a9a50b76e8fff419ad39ce5ead6487a70308743c42c7a8e9d5b47cf4ed73359fab6185a38b1ce47f8388c8439867e5d1ce106014d785864f1333e12422d65730e7a093278bb45351451c7e9c93a2567e0313f2b9421acac8faeab2b33f89a5037c5f901b555024d50c17ca13aa1de9bcedd3554e498fc116f7c13b3fe0267b22983590f8d947673bb1ca198a443519a3c32a5b100218be737bd778472c45fea1656a285a0e7aac438cc87451820199a3cd182536b048740f3ffdc06e0f69b2b127ef7fc56aedf93c2c9bcc3f3d47f69ebcd195c4fe2122cff3fbe3add182e60cdb83f8dcb587e8c269a27f1210a602913dd7f004b3c1c4457298cbd0691dd90fe2c87bf693c71ab0ac7f57657d353f571b1f2eede0f2315da9e7951c2aaee84658ff52c2c59cc08ccd639f723bfb790b976dea33e2a4db213e7d0e9965da35f1cf5effe715e4d0174b1a60a08eb152a7f9f38a93a883eb3cf34a22bd60e71a513c31dbd27e0ab9dc0d779be252a1734bcbef4485c72cdb250669215e454de7aa"}, 0x0) fdatasync(r3) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000480)={r5, 0xd759, 0x2}, &(0x7f00000004c0)={'enc=', 'raw', ' hash=', {'tgr160\x00'}}, &(0x7f0000001d00)="3f1780a9ee30ec7d00438973e50b1db9f4fac3877f00855d029e6602c2c65cee85905945d5291ef6fe533c4730d2a8cd0a124970ad2040d9bb172ff52e7c6551904d6215ddace3d47a060d17786198e3794705084e50d5b897adf518cefd07f3dfb665a919ab3e359574bc84b4eed89b3cb68d423b3b96eed7600060202946d0a251ff6ae25b814dcb88c8d3515e24054cdb25750956d20755366ecf16444cecc08e75a30b302ee1061f6ca448f7ea5f3bb3e53827af50db13bf8d36b90b8bfb8ec12d636bd0139c7d2de5133509309cee2782151182ddda65af30abad24aa963240a713e62fc55c71002cd7423ac770d896708b2ebfed1988fb7ffedc12919111f09364108cd2217bc819b25d9ea051efa1e05950cf8c621b127dc6ab4009cdbda6d561113f1c07d47e8fe3d061e3414988c6cc443299c591383c5b3ae2cd3412561e69c213317266916863489cf59e702b5c48dc7e0373dadee104f29a760429f8b9e1a8df31bab81a6d815f552caa361a4be9cc0b21ac8ea264a090478128bfd66036569a2dd84b9a50bf64bdd9432d666ea161b0581ed3a76abc7a1b4c729b82865d055d72fb486fadf26016f7eb49c1d881b0605d10a90fd5d66a6ea1d6532e414c644d1b8d45fdd682d4015d7c133a290bf2e1fce4566cd7267a43793c7d5943b0d72d876fb84c344b65f75e9763b7cf67184aa5edbdba5b84faafb8f2d07b444afa5ab5caecddff3615324609e64b3d45994f119875338fc44f87227e0a36b1a6e727ff54a283789c09a594b2091ddaf91186954a796ff99023af488f5a815e9856835a0c3c2417de388c9b96c186b583dea6a6ac9b4ef66c19450535b6f0d54a79c8fc03b66351c71010536afeec7f39e12d3d33581f1d3047bc43b23a8f5f2013eb011fffcaea957338158c3b08470d579774e9ef7a8f7e3cc90f6a91907b4b4d4485d224e1bee31e13ffc6baa18ad4aeda1509a93e887bf06709d6a2af6af22def96f385659389c44209dd8de0707c88fa3cf3ee455ef6ab1bd2ffce13a40b67732ec76c1f3f28859e49c517a3cf4d07a934dca5271c4a8fb1e41e26d95adb98462bab0d2a5fa47be50ef4a6b6b46bfa4a36c98a7a14b842a02ed4ca13aea915adeb8ec55b46c4ce802310a58d4bc329c5016503d32e25c0b33bc6f3b131c028d6e2074aa6463ccaeb202125cb0c8d57439ce308bb23f3f1ca1dad8654ebc610b1c72175b501530bb997f5d7964a2619052b1715342afd0719de1011d44d9179fe3512b2e703ed912afd8d3a005ba353acb092573c262578416c27e359720a208809da7b58ded71b32687f96edd857ca50b85fb006e5b17d941728bf748232b4df94cd2416c0e8d11d113ff0ed9837fd4e9b2495ea0623d1466bc8b4ed16c717b6d2878d3e05c2b4855f00663cb505bcbf92026fd7dcba44d211e4479e01d4aa79a57d4c521a7c60879d2ee0fe5b0a3cf557d5bbe200c9121cbb6122e70219b816d87bc660fce8baa01d420ef41fa08a129142fb9c82c10847bda16ae93e23f0b035bab1381f941d1e4a9f7ec318490bcec4a0c2a52a41eb83ddf19c691506e80c0d89c007f2382537d303f8c49a841521493d55057a51db2d37a12c893c324d185ace9b8dd033a29ccbe72eebce5f180f48af81ac78269dd9b9570f9899b226adb8ecb76f1a5fb113d82dad98dd51b0c735a52872c5f71d20671e706b375220c7546fc202cef5c1d1ff16143eae6460f113edec414607a414cf4ccf500eab22ff6e9bef7f807a5ce7d2a6d1fcfb6d5e8ca0c2011cbd418bc3eff090e188024a4192b6e32dbaface4399cc85d273afaebf824fbcd4ce0ae3695e3fdd4af188f9d2e9dc3a4e6cc40c1cfa494293648b13f509c6c12457a7048ca0eb56b3008614b8dafd613bc40760510dd444393645cd258cdae1cd82af45013d7078d99eb08f377ad2ca214aa527fa7783a751d510511ed59703d4c034d9540c9e17a66db03201b00e989cc948d1fe3edd2f784c65f74f7d5ea1cab390e6de63be995facf735fa169255c7e84211bdfadf231c25f1f6c391c0a8db620b2acec15e82995fed0278e9aa5a2ac5d0b1b4163fb4ba9151584bde6aa3ec00d50ea0e210eb62d027629504c5d5ef2ed732a1a20a4d2af46158d292c6d716a4f8bbc80eb60043061cf668661b1ae0f4d873f44286dd6938525303a043bdc8df388fe66b58400804278e428da7657cbc9f28f5a94e2d7681eed795f67ec740723e0b77e5ae36585a7b41e67c9705c6e70b2d638c06280bb9bd46a6bb49d53df509da72355573460de0be72a3d82dfb49e236e32f1d6fd3e4dba6e60c36b5cbeb5dc2e35b9a6aaa6a8e2629999cf800bd7ad5f7971b933647f8c3c343abab1b5dd1908ea0a8c66d9b3d152c092f96c05ed0af317de182b2a8b7c5fa9bd9387f09d3c6efaf974839230dfd034d51c89a148843fed2b9231c1e740f4cb63eafd47ba0fee95642c8f1ecdf6ab2197af87320a272d98710fcb9c1e837aa4485714d16cbb1ecf9b1a3e6dd1b0f10bf4935f175560c93f6bc4fdd94b7e32b0d8f8de0d711f8db12b2f215bb5819a87263468bbda10a8efc8097ee6d6519a1307ae8ac8460b4f741789f3b22a4ee4630e6fe47bacf25dd1eb6aa32c6b908e1a97eb4c20773ce1d531de7b00e03ffd85d9e779038c34c733ebb27e6f5bb9f41c160adfc062d4c94220d68605cddad8fc346852190f779bc2c9d2ece357e8330f05ac14fa8c10775e2edce93bd5cb19dc1a5e77022bd229e63e4e2fcb26862a207ebfc196fa3d2eca2f6bb206337ee40cc66fa832530ce3e7257e81e49742cd39b512688cfeddc4f9de95f91cc5076bf5b4fda791d4c9f3cc685ba1457e32ee710bb44ac040781d598216fa8b0f7e34e3d9a4d5a902889abcb1dcec9d7d3dfa0d1672497fda024cdf27856aecb9730ccd668b953b088c50f1ac76c836613a4f81215504661cc41ec9fe8e26716d0fa1d67056a1783b60256018ea3949d7a77800c07fca340769734941efab14ebc216ffdc45ea89a7b6711a33186200261079f1c1a6657c9c7a9b7cb7ec42c0e84fe2de927dd699b2e22f5e35083e94f3373a40e8a87f7609b6f5f6b63f6894a776500c7f521a85ad524947b0bf8875003026ce796e3dc79fd2f58f3d72befdc71da067b35e745fba687020912c99ffb091efb768132e5e0e81329d8dd0152ac709ec6709451e403a4e4736b3020a78a8f13ba6b066a384baddb3fe58df255526c103816a77ca27cb339ffb71ad3176076f17f27761a562e561738431356f1d6d5d72cf29a023820419ef78616947423dae3e60b863d34f4ae721c51e3b85863d0c6be720a8970e8d3a6c8fd9ba1a4504e7b3fa3d95380e335a2fb08a57480afac8b36c941f972fa4c098ef1e3fc8f6932e72efe8ba436ba92567ac4954742791c0a790362a624f8d356a637636d319127262fa7d1d361ca5026636d838ba68e3d79a38a0dd241c785798d151695bc4253590e7f7bb7281b29f278b163bb078b4fdc600a5f271ca0c5706e141bbd20ab7cb39c662831ee72483ba90f7173267da999e141fca3c2dc59a43fc707ac37d130a08e2131e3f9a50b19c76139c3dd033b2dd55f52768df66d4b3f24c789a5beb40f182413c0ec464f9fdbf5723b364f4fb7bee522f93f86fc948a8f2b31a06503a9737d1823d126fc903be1e6a761c4999a3e36e5ff5a8193eb38a10cf70f3c92b8d77ab7b68d786aa83eea6c44519b339cb9d9f033e4a96ce16d18d66e4c548e4d5d9eeed9f7121f1afc064791c7269afebe96b8de55bf80a271413119ad561e151c8f54a807f139c0f58e1aca84028c458d3411e95718cca728f11017292005bd86aa87b112b75fba0dac10c8e47863c256d2de2451a4833b96aa3784be6892eff87a71b6f0e34a7d3cecd847cca5a9aa9cc34491cc1d943d1efa935bc259f04da86bc8f4035d4cb810a2be90f7af3630678442da3ecfca9f95d25ac114e006a8156b432fef8a26c63f164fb7661699bb8a4d0c59bc93cd51a8eebf1137406d4a2e3f1807d92799266d67917ede1004c91907cefd26750b70fb6b018e31f0d8530645a01e4b085dd2d1c59362497c4dcbcf7ef75a3340b1695f59be84a5c78db3c42ff346613bc0a524816fc845212bba3ff7a027f938b116a1129bbbb5a20a810944d3edd203319cf354fa8a7c7e1cdd882718c491da9702bd9130be1bd27dcbe8668892cc8cbbc8b0cd6590c6d5ac3b87c8a3f9ab5ec1edabf0a99f32166092c1e17715dee4fbfdff2bf17afeda720cf35a2196aec339f1b5a05a0ad9f3cbd8516d96a65b1d43f8aaa28639e900d393d8b63d0abb89d7dace26377ad34a0844b0e33b6bf667c14350f98e614c64bd66b274935fd0b5fb94da5ad47062e3c93522b27efacc04ce77611a61e58ee0da4e8c2ae2dae433ccd9ee7514c9500eb092ea4beac8a2328fd3d2352fdf916d1eadb358bb2d15b9549cf7984f3820fe8c65efe23fe3a183e08c5fd194f5d3f47e4b99e62933cd5ed04a3550b30f2d48ca9e38581a714ef6c8ecf887bafc7f4e3d49b7ef442e6f66ef6a3d004c0ac60f37f3573fdea63dfb83d6ec2ad6815a4f6f36a5d99a6d3b396d28e1873bb2e5552209d976a19a0cca78bdf3f38271c6cc151f2979c0ccd45e866c3e30459fd01cf08f9b47032887e8842f80cf6ade0c6539580d6357eebe28c46ce9bbb9af5aeebd593d60684fc21a43e486dfee1cf3370c5e178e078d0f79a358ed887e4ccadf54b5e1242b83431a323881b3a2a0150c8d65f966444b176041ed72f476233f7e2e83ba551ee53830ecdd7bac050b78863f18172c2629976dd125a62cf644c097153319f788abb83b7f93b2464fb54fbaba16b2fb3bfc776ed4897b1fe3cb35403ead8bb1ed035b67843eb2c7cf911f3211e4a6065541e75967c458f915eced57a1438e570e8f36cc39c030d162968614da06724e9a12e6ee65e22faaae7b49e80234669820fca8fcde92aa504f80d3101062007a9d9bd2bde119d08eae3713d04d1e63fd6793cf06fa7ac138bbc11eecf978b7b40c94031fea42c1b08e86b18a3122bf96f5237a79f0743a4f4b8085072a4522e15a13ae8307efd52f7e203254c9cd408ea4e6720a76a283df027c273deb481002bbda477d0ce7d8dcbd7b94e0e4dfd3900ca0685b58ec8ff82e5f2313110739f85fd96e0f0abb03b327d95681caeffb53971c9059b0221f348e43a97dfdc8a8ac575860b3d05aed87b7b29918efdcc931f6080045e635a3dc0471ac108fcbd76d8bd237284073b3c7901f9fd0c4fc2f90cff873772c39fa88d9a7590b05549c4a8523498a6930597f0a83951379c9e9b2323b95c77bc4b4c49f8170c8349b1a90cbed5a784714e25d607dc99eaf48ba1beceb929baad9a18b8a2e865019050ea82bd6f9bf71387a0d4381d155e051b8965b499086f5d76c9732e9d521c1d6fb5a03315ce8a2d1fb760131d5a71004bbc37c66de2741fae258a044ed4773f347015a7844f877b5d3c87ed39917cc878f142a43c2cbad8cb743bbcae1cd39f2432a7ecac82cc742a748a7894ee16d4f67a14821f3b2f4919af2cf1b1062e0e27e03e0a79634b19eaa9d805822fd33deedd42f9a7393eb510d9027ccbe277ee9420e7c0d684232592a19ff44f0db934a20f553c4032305bb1fb9d209a6dee8dc2855b96765449dd266f1cc993f6f3f1e4b24f63d5ec81e1c76a935593d4f292cc525aea9aa6a50f6e39790d5c2af75bf4c08932754dfb6f9dbb2ef", 0x0) 02:23:40 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd", 0xe) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 447.371473] binder_alloc: 23316: binder_alloc_buf, no vma 02:23:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000200000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:40 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd", 0xe) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:40 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, 0x0, 0x0) [ 447.520781] binder_alloc: 23351: binder_alloc_buf size 4893816 failed, no address space [ 447.608570] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 447.644393] binder_alloc: binder_alloc_mmap_handler: 23351 20a00000-20e00000 already mapped failed -16 02:23:40 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:40 executing program 1: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) add_key(&(0x7f0000000180)='id_legacy\x00', 0x0, &(0x7f0000000900)="3c373165105946b830309eb8a473c2206adb1686bc021a1745d2a6362299fdc7c7775b672d5be4835b7056734690028bddcba35b453e845e4e7141396fdd027ef92f27a8a77b771098dea3d338491df764d68b5fbcc33439ffb77b92f81b9bd009bf7a240e43b1d0307751ba302c418c6f5783ca36b283ad7ba9c176", 0x7c, 0xfffffffffffffff9) getgid() setxattr$trusted_overlay_opaque(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)='y\x00', 0x2, 0x3) add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e53859ab66e5a7a138734b4777a1", 0x34, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r5 = request_key(0x0, &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000400)={&(0x7f00000001c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0) mkdirat$cgroup(r4, &(0x7f0000000240)='syz1\x00', 0x1ff) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(r4, &(0x7f0000000000)='./file0\x00', r4, &(0x7f0000000100)='./file0\x00', 0x1400) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f00000010c0)={'filter\x00', 0xbf2, "69d3713904c22c1d329ceb56d8a725939535712c93062efab07ccdaec656b663f5591ed5f0198e3becea8c7c6b1215a38d35109f79503827f73371219339aa28b8dc13428b24af2763efcc137e9c0457d10f7a497657b1975492a4729c9f4c40003142098601e979b20fd9ce56c82b95f17c9ff5072b5dc761109e5d90b12cf839d3de038d3aa9e8a73db1b773f376ec943c269ad2a65451c842c64e47f645c37188375a77ab07408cc1f6eb6aa693b3df527c56a6b93b3d522e4196a59c51e7cf5da4d754ad9338080cc33c8cc291d594f49bf0a2d48437bfa34b99e8b73f93c06b314bc2263b164741d10a964cda633297e6a28024c1c1fe8f1565dfb2031614c642746748f01c5ab2baaffbc7ec24c814f0e4ad3591145cb35951957c659e8d8241761d7bef600eacb2db029ff9ff95364e438313211386688bb3b2b6fb054d6f225eb4a8813d3fed880ecb552fd93cee9fe816f88f188e571ee4c1b594f2961c7a53086da38ccc3bbe528127e81f5f739b22836f9256a61e8c83b3a438c89c74684d1af2e7c2f3b5cb3d51d22ee5086517334456a137bca584e189feefaa2cfbd211d33668fe17963e9c02cd5776b7ced2cfcab7012b15220b95e95ca9c819c76dbdc34459674f1b4e2b25055dc018cadea56e77be469d82b38010588bc9aa3624a341b6c5842a0fce83f986650740e0e93d0ae2da7b684b9b1465e1667c70a1a1a6aa5880c6ce6b19aca8517c24abff7c7b3e99e045c62a9df3ad67ae810dc93316b69500d7205b7b937774f324938da53704667aa2ecf3854cbfba961186cf395a14b2ddcd5984a9ea3b4c189c2ee01f43bf26b972f739f201836f3a98acae28a3aa4216c1b57aadf78ce6482a2708480d593667530999ea85a8388add797e498b3c11ab7e40339af895c848c6feac14e29e521adef564d65e77fbfbe6c21ca8a257f47e042689b9027d8e56c0baa644496985cdbd90bc08db3c4f0e58a8fad759d1b431b33aeff1615e15f19b45b8bc74e9200bba77ee79dedc51fe9793f7cd6cdf185f66834f39267487442006d0d0f64996078dc6f05e157a3e49d790783a61e91222663c5f3706bbf89546ceecf84760e596d3f50f01bf49fa394b814fd7d128d1d1e951896729b53e3c4376a9bad5ea3bcdbf7a6cf4644ab708b490c4d8685e3f7cc1e4bdfd1b98991dc9a86d72b97fd573db5d6fea899c3e622d637054868caf431425b1e8edc9709302ad9d92d5d93c5672750ecb4273f185d5ac697f6588499775ffbb74ec25a1382013c7c1cd9f5d2531e6cce64daf91ce9535210bc88a1f9059cb7e73a2b4a7d537d56104be9ae70c0d5c456d7ab71281eddd34fa4db60d129af84f0e8a02246f6ecb431d5bc9630ad8d1c672a50697de8e0fad06d766d0e2fe70432ccab10a3606fcaa2a12c2814f1c0c0730c3256331711cd8e2a32cb2941f24058d60e3d2b501a563480519ea3d388948f5216265c1ae0e3caabb8cba4de6ee433a26c5a6ba521560f54548e7176f6b050a77814108e6799a4cfb8bafc0f7cf48f0edeab0be49947902e34a38bbe50d7fd263fdff158d6b4a141c12ff9c4147761c92db19630e2de0ec921f6df5093fc2a5955478f1a1cce0b3496bd91377cdf0a143b76616186251a184cc03eb8369850733a6bcb3bef04d22d57f7c2b7eb690b6229ac82efd765464caee43928792bd80f712ee4081e6fd05af00b1a8c287093cf961003ca8f5254254841e601b33e2d5b7c28d02e9ec15ce596d75e14b0c6cbf086e4e5ddd3b2390a42a80aed86346a1a4c6acf1f822a44d8206418676a5c50aae527b24ec1861214c29fa6f25db2ce0c9b0f12a5dfb7dbc19b94a9d77277aaa533654000767cab093dc9874c5d468221778c33d4e49e3ccd55da84e9bbea42b7ffec6620eb749909692933d86e72d5e6a2c34874fc1cfdaebf56c9ff74444858d5c9245e47a63927402a8d391514936658c1465e45e04b11564f1564693a6ec5bd491bb674a86b69d8438998ee3c154ecfabf1aa6dd3bba00c448c4cf4167a1a0cdc4855c2b6206a2abf25888eda11a5360fcf5916dcadbf07a3258b7397bab4a67a6f1ed1e78d2deeb57231dd0524cafebe6d6e812758bcb9e1c9460d7a7cffa58faae16b0ade26eb792a7c818f2b96e9a3ce493fe47ec1ac4bada7a57d6e9564b9be4c65a2663e869134ee2bb1340c1c1d368022112aed7593b946874eab7e3ee205ff6a119d8857dc4236f3e9920b0eb15e20fb46ea21763bf97e5080132d322aeca3af874f58f56acc55aa2ef6850e330377ee799edbd4826b2618c758e413ce2352cb309d4f4d632a4283f3965e8f21e415321241f1e2e4f8ec2d58c70fb0b47667a455349fafc7b60c14c9e1e6e9cdd7834019782424d442f68d6d3af3f9cb908af1fdf1f04397f2ed24f14ca9fa0e351f1a63f7e19a147349fff0a33f56cc30b2271595dfb5d6f3c977ade1100c25847becdd2c13db8ffcef10e7296031601fe383ab3f957ce89a0fde6dfdb76b60cb89e63d38261eae2115d59cf155336c83a5ae86211db5e56416c38d7cefc458b1dcac45fd6639912d5d5ecf80da1c1fd7c5e27646732f5ba56c84b4aa17971f0094b0b707246fb5f102fdbfda28eff48f21e334513cc981298fa2caaa5f88013a7ecdf46f6fcd0dc226a1fad9ebacc081d4fdf08e516b8b74c8e8e6d3e3e32674031a96f238e3f74a9cca3ea8d9c3cf225a91ed1b7fbb6a314632af8a3e8be4995b05e1228a6a24a161f66771d1d34feec2f7d922d14d58bcb1795343edc732309c97efacb1470d8767217d5a12732e6c8cb5438b481c175d985e8356fc009d1a86927236ec1ecb4b6cf3d6639e5917dc0924584704676528db1b3635e90c331a7db74f4b3bda09359e164877fa83a3c68e4016a752d54426afffe732276502b59a725c3538c0db60e7ae8e32235a237783c43973ec1babd30a62839a8f88797e68ed3b32f054f891a2e6f1a44fa731f06baf8eede29d8a2272822956b3ccbe4dbf0651f5fd786728cefd11500f09465da0113422e600f1ebfde7e5f6e5f8d350a3e628de03f524d20c17845502d5f925de14b82f5a05362e3e866c39a78b11f02da18c0e81bba4d881d645cccc59788838e2453a17f5367a4b90ecfc8004e6b7cd3c86a4f763b88ed588c23767bbea94fbcd353efa1471500b6ac7cbd94457339e9f07357e3d05037af1258307a08704ceebc701d6b3d4c76026d5cd4d6c309b1c129c7c6be8ba5ba648562a3fa49cbe0c7bb94f9ec3dce65a9f62e261f8c8b2d0e248083177589e1690932688f395b4ecb0183beb1fc494d8859f9e4e48eeaf5460e05d5f7c189ae3e18be3cbefa86d02142cd0bfd8fef87010d4a91fb062cbe698e7b50c90be90081f737e9a204053fc35377fbbd2ec7dfc4c79f12457cb1309e61eaa6c773e5f4abd78b01305d099332a2c9c0d6f9a9156b0b19bfc21d68de6952bdc8f0ff6391bee508519ac0a33d361f2b8d802d5248b5c709554cd93e7562d41b4f725c76d2c466ad8995086bbb5cdcae81072e87177bc5ca62a9e2fedbf92cf7e22e15f1e1a3a03919f9876a1d58baa76f0d87e5b461a7b540efc39d20aa00e517c0b5546bdd7a8b7a08d4af382e5457dc9c4957bc5099c43f161e53955fc286a86ac5b3417c7f9855590554578247d801458c4e0fca9f78f37260e2c576ee7045ab66b2198bee93df75614e7d3aca7f4b4b494f3b61a2774f00efa1624516f58bac90e9d1eb898cf3cb386e11bfd303a9a50b76e8fff419ad39ce5ead6487a70308743c42c7a8e9d5b47cf4ed73359fab6185a38b1ce47f8388c8439867e5d1ce106014d785864f1333e12422d65730e7a093278bb45351451c7e9c93a2567e0313f2b9421acac8faeab2b33f89a5037c5f901b555024d50c17ca13aa1de9bcedd3554e498fc116f7c13b3fe0267b22983590f8d947673bb1ca198a443519a3c32a5b100218be737bd778472c45fea1656a285a0e7aac438cc87451820199a3cd182536b048740f3ffdc06e0f69b2b127ef7fc56aedf93c2c9bcc3f3d47f69ebcd195c4fe2122cff3fbe3add182e60cdb83f8dcb587e8c269a27f1210a602913dd7f004b3c1c4457298cbd0691dd90fe2c87bf693c71ab0ac7f57657d353f571b1f2eede0f2315da9e7951c2aaee84658ff52c2c59cc08ccd639f723bfb790b976dea33e2a4db213e7d0e9965da35f1cf5effe715e4d0174b1a60a08eb152a7f9f38a93a883eb3cf34a22bd60e71a513c31dbd27e0ab9dc0d779be252a1734bcbef4485c72cdb250669215e454de7aa"}, 0x0) fdatasync(r3) ioctl$DRM_IOCTL_SET_SAREA_CTX(r3, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000480)={r5, 0xd759, 0x2}, &(0x7f00000004c0)={'enc=', 'raw', ' hash=', {'tgr160\x00'}}, &(0x7f0000001d00)="3f1780a9ee30ec7d00438973e50b1db9f4fac3877f00855d029e6602c2c65cee85905945d5291ef6fe533c4730d2a8cd0a124970ad2040d9bb172ff52e7c6551904d6215ddace3d47a060d17786198e3794705084e50d5b897adf518cefd07f3dfb665a919ab3e359574bc84b4eed89b3cb68d423b3b96eed7600060202946d0a251ff6ae25b814dcb88c8d3515e24054cdb25750956d20755366ecf16444cecc08e75a30b302ee1061f6ca448f7ea5f3bb3e53827af50db13bf8d36b90b8bfb8ec12d636bd0139c7d2de5133509309cee2782151182ddda65af30abad24aa963240a713e62fc55c71002cd7423ac770d896708b2ebfed1988fb7ffedc12919111f09364108cd2217bc819b25d9ea051efa1e05950cf8c621b127dc6ab4009cdbda6d561113f1c07d47e8fe3d061e3414988c6cc443299c591383c5b3ae2cd3412561e69c213317266916863489cf59e702b5c48dc7e0373dadee104f29a760429f8b9e1a8df31bab81a6d815f552caa361a4be9cc0b21ac8ea264a090478128bfd66036569a2dd84b9a50bf64bdd9432d666ea161b0581ed3a76abc7a1b4c729b82865d055d72fb486fadf26016f7eb49c1d881b0605d10a90fd5d66a6ea1d6532e414c644d1b8d45fdd682d4015d7c133a290bf2e1fce4566cd7267a43793c7d5943b0d72d876fb84c344b65f75e9763b7cf67184aa5edbdba5b84faafb8f2d07b444afa5ab5caecddff3615324609e64b3d45994f119875338fc44f87227e0a36b1a6e727ff54a283789c09a594b2091ddaf91186954a796ff99023af488f5a815e9856835a0c3c2417de388c9b96c186b583dea6a6ac9b4ef66c19450535b6f0d54a79c8fc03b66351c71010536afeec7f39e12d3d33581f1d3047bc43b23a8f5f2013eb011fffcaea957338158c3b08470d579774e9ef7a8f7e3cc90f6a91907b4b4d4485d224e1bee31e13ffc6baa18ad4aeda1509a93e887bf06709d6a2af6af22def96f385659389c44209dd8de0707c88fa3cf3ee455ef6ab1bd2ffce13a40b67732ec76c1f3f28859e49c517a3cf4d07a934dca5271c4a8fb1e41e26d95adb98462bab0d2a5fa47be50ef4a6b6b46bfa4a36c98a7a14b842a02ed4ca13aea915adeb8ec55b46c4ce802310a58d4bc329c5016503d32e25c0b33bc6f3b131c028d6e2074aa6463ccaeb202125cb0c8d57439ce308bb23f3f1ca1dad8654ebc610b1c72175b501530bb997f5d7964a2619052b1715342afd0719de1011d44d9179fe3512b2e703ed912afd8d3a005ba353acb092573c262578416c27e359720a208809da7b58ded71b32687f96edd857ca50b85fb006e5b17d941728bf748232b4df94cd2416c0e8d11d113ff0ed9837fd4e9b2495ea0623d1466bc8b4ed16c717b6d2878d3e05c2b4855f00663cb505bcbf92026fd7dcba44d211e4479e01d4aa79a57d4c521a7c60879d2ee0fe5b0a3cf557d5bbe200c9121cbb6122e70219b816d87bc660fce8baa01d420ef41fa08a129142fb9c82c10847bda16ae93e23f0b035bab1381f941d1e4a9f7ec318490bcec4a0c2a52a41eb83ddf19c691506e80c0d89c007f2382537d303f8c49a841521493d55057a51db2d37a12c893c324d185ace9b8dd033a29ccbe72eebce5f180f48af81ac78269dd9b9570f9899b226adb8ecb76f1a5fb113d82dad98dd51b0c735a52872c5f71d20671e706b375220c7546fc202cef5c1d1ff16143eae6460f113edec414607a414cf4ccf500eab22ff6e9bef7f807a5ce7d2a6d1fcfb6d5e8ca0c2011cbd418bc3eff090e188024a4192b6e32dbaface4399cc85d273afaebf824fbcd4ce0ae3695e3fdd4af188f9d2e9dc3a4e6cc40c1cfa494293648b13f509c6c12457a7048ca0eb56b3008614b8dafd613bc40760510dd444393645cd258cdae1cd82af45013d7078d99eb08f377ad2ca214aa527fa7783a751d510511ed59703d4c034d9540c9e17a66db03201b00e989cc948d1fe3edd2f784c65f74f7d5ea1cab390e6de63be995facf735fa169255c7e84211bdfadf231c25f1f6c391c0a8db620b2acec15e82995fed0278e9aa5a2ac5d0b1b4163fb4ba9151584bde6aa3ec00d50ea0e210eb62d027629504c5d5ef2ed732a1a20a4d2af46158d292c6d716a4f8bbc80eb60043061cf668661b1ae0f4d873f44286dd6938525303a043bdc8df388fe66b58400804278e428da7657cbc9f28f5a94e2d7681eed795f67ec740723e0b77e5ae36585a7b41e67c9705c6e70b2d638c06280bb9bd46a6bb49d53df509da72355573460de0be72a3d82dfb49e236e32f1d6fd3e4dba6e60c36b5cbeb5dc2e35b9a6aaa6a8e2629999cf800bd7ad5f7971b933647f8c3c343abab1b5dd1908ea0a8c66d9b3d152c092f96c05ed0af317de182b2a8b7c5fa9bd9387f09d3c6efaf974839230dfd034d51c89a148843fed2b9231c1e740f4cb63eafd47ba0fee95642c8f1ecdf6ab2197af87320a272d98710fcb9c1e837aa4485714d16cbb1ecf9b1a3e6dd1b0f10bf4935f175560c93f6bc4fdd94b7e32b0d8f8de0d711f8db12b2f215bb5819a87263468bbda10a8efc8097ee6d6519a1307ae8ac8460b4f741789f3b22a4ee4630e6fe47bacf25dd1eb6aa32c6b908e1a97eb4c20773ce1d531de7b00e03ffd85d9e779038c34c733ebb27e6f5bb9f41c160adfc062d4c94220d68605cddad8fc346852190f779bc2c9d2ece357e8330f05ac14fa8c10775e2edce93bd5cb19dc1a5e77022bd229e63e4e2fcb26862a207ebfc196fa3d2eca2f6bb206337ee40cc66fa832530ce3e7257e81e49742cd39b512688cfeddc4f9de95f91cc5076bf5b4fda791d4c9f3cc685ba1457e32ee710bb44ac040781d598216fa8b0f7e34e3d9a4d5a902889abcb1dcec9d7d3dfa0d1672497fda024cdf27856aecb9730ccd668b953b088c50f1ac76c836613a4f81215504661cc41ec9fe8e26716d0fa1d67056a1783b60256018ea3949d7a77800c07fca340769734941efab14ebc216ffdc45ea89a7b6711a33186200261079f1c1a6657c9c7a9b7cb7ec42c0e84fe2de927dd699b2e22f5e35083e94f3373a40e8a87f7609b6f5f6b63f6894a776500c7f521a85ad524947b0bf8875003026ce796e3dc79fd2f58f3d72befdc71da067b35e745fba687020912c99ffb091efb768132e5e0e81329d8dd0152ac709ec6709451e403a4e4736b3020a78a8f13ba6b066a384baddb3fe58df255526c103816a77ca27cb339ffb71ad3176076f17f27761a562e561738431356f1d6d5d72cf29a023820419ef78616947423dae3e60b863d34f4ae721c51e3b85863d0c6be720a8970e8d3a6c8fd9ba1a4504e7b3fa3d95380e335a2fb08a57480afac8b36c941f972fa4c098ef1e3fc8f6932e72efe8ba436ba92567ac4954742791c0a790362a624f8d356a637636d319127262fa7d1d361ca5026636d838ba68e3d79a38a0dd241c785798d151695bc4253590e7f7bb7281b29f278b163bb078b4fdc600a5f271ca0c5706e141bbd20ab7cb39c662831ee72483ba90f7173267da999e141fca3c2dc59a43fc707ac37d130a08e2131e3f9a50b19c76139c3dd033b2dd55f52768df66d4b3f24c789a5beb40f182413c0ec464f9fdbf5723b364f4fb7bee522f93f86fc948a8f2b31a06503a9737d1823d126fc903be1e6a761c4999a3e36e5ff5a8193eb38a10cf70f3c92b8d77ab7b68d786aa83eea6c44519b339cb9d9f033e4a96ce16d18d66e4c548e4d5d9eeed9f7121f1afc064791c7269afebe96b8de55bf80a271413119ad561e151c8f54a807f139c0f58e1aca84028c458d3411e95718cca728f11017292005bd86aa87b112b75fba0dac10c8e47863c256d2de2451a4833b96aa3784be6892eff87a71b6f0e34a7d3cecd847cca5a9aa9cc34491cc1d943d1efa935bc259f04da86bc8f4035d4cb810a2be90f7af3630678442da3ecfca9f95d25ac114e006a8156b432fef8a26c63f164fb7661699bb8a4d0c59bc93cd51a8eebf1137406d4a2e3f1807d92799266d67917ede1004c91907cefd26750b70fb6b018e31f0d8530645a01e4b085dd2d1c59362497c4dcbcf7ef75a3340b1695f59be84a5c78db3c42ff346613bc0a524816fc845212bba3ff7a027f938b116a1129bbbb5a20a810944d3edd203319cf354fa8a7c7e1cdd882718c491da9702bd9130be1bd27dcbe8668892cc8cbbc8b0cd6590c6d5ac3b87c8a3f9ab5ec1edabf0a99f32166092c1e17715dee4fbfdff2bf17afeda720cf35a2196aec339f1b5a05a0ad9f3cbd8516d96a65b1d43f8aaa28639e900d393d8b63d0abb89d7dace26377ad34a0844b0e33b6bf667c14350f98e614c64bd66b274935fd0b5fb94da5ad47062e3c93522b27efacc04ce77611a61e58ee0da4e8c2ae2dae433ccd9ee7514c9500eb092ea4beac8a2328fd3d2352fdf916d1eadb358bb2d15b9549cf7984f3820fe8c65efe23fe3a183e08c5fd194f5d3f47e4b99e62933cd5ed04a3550b30f2d48ca9e38581a714ef6c8ecf887bafc7f4e3d49b7ef442e6f66ef6a3d004c0ac60f37f3573fdea63dfb83d6ec2ad6815a4f6f36a5d99a6d3b396d28e1873bb2e5552209d976a19a0cca78bdf3f38271c6cc151f2979c0ccd45e866c3e30459fd01cf08f9b47032887e8842f80cf6ade0c6539580d6357eebe28c46ce9bbb9af5aeebd593d60684fc21a43e486dfee1cf3370c5e178e078d0f79a358ed887e4ccadf54b5e1242b83431a323881b3a2a0150c8d65f966444b176041ed72f476233f7e2e83ba551ee53830ecdd7bac050b78863f18172c2629976dd125a62cf644c097153319f788abb83b7f93b2464fb54fbaba16b2fb3bfc776ed4897b1fe3cb35403ead8bb1ed035b67843eb2c7cf911f3211e4a6065541e75967c458f915eced57a1438e570e8f36cc39c030d162968614da06724e9a12e6ee65e22faaae7b49e80234669820fca8fcde92aa504f80d3101062007a9d9bd2bde119d08eae3713d04d1e63fd6793cf06fa7ac138bbc11eecf978b7b40c94031fea42c1b08e86b18a3122bf96f5237a79f0743a4f4b8085072a4522e15a13ae8307efd52f7e203254c9cd408ea4e6720a76a283df027c273deb481002bbda477d0ce7d8dcbd7b94e0e4dfd3900ca0685b58ec8ff82e5f2313110739f85fd96e0f0abb03b327d95681caeffb53971c9059b0221f348e43a97dfdc8a8ac575860b3d05aed87b7b29918efdcc931f6080045e635a3dc0471ac108fcbd76d8bd237284073b3c7901f9fd0c4fc2f90cff873772c39fa88d9a7590b05549c4a8523498a6930597f0a83951379c9e9b2323b95c77bc4b4c49f8170c8349b1a90cbed5a784714e25d607dc99eaf48ba1beceb929baad9a18b8a2e865019050ea82bd6f9bf71387a0d4381d155e051b8965b499086f5d76c9732e9d521c1d6fb5a03315ce8a2d1fb760131d5a71004bbc37c66de2741fae258a044ed4773f347015a7844f877b5d3c87ed39917cc878f142a43c2cbad8cb743bbcae1cd39f2432a7ecac82cc742a748a7894ee16d4f67a14821f3b2f4919af2cf1b1062e0e27e03e0a79634b19eaa9d805822fd33deedd42f9a7393eb510d9027ccbe277ee9420e7c0d684232592a19ff44f0db934a20f553c4032305bb1fb9d209a6dee8dc2855b96765449dd266f1cc993f6f3f1e4b24f63d5ec81e1c76a935593d4f292cc525aea9aa6a50f6e39790d5c2af75bf4c08932754dfb6f9dbb2ef", 0x0) 02:23:40 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x522000000003, 0x11) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x9}, 0x20) sendmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nl=@unspec={0x0, 0xffffff7f00000000, 0x7e4c, 0x80fe}, 0xfddd, &(0x7f00000001c0), 0x12f}, 0x0) socket$kcm(0x11, 0xa, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000a01000000000000000000009500000000000000"], 0x0, 0x5c0}, 0x48) 02:23:40 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd", 0xe) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:40 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, 0x0, 0x0) [ 447.689360] binder: BINDER_SET_CONTEXT_MGR already set [ 447.724004] binder: 23351:23352 ioctl 40046207 0 returned -16 02:23:40 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b", 0xf) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000003f0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:40 executing program 1: openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, 0x0, 0x0) write$binfmt_script(r0, &(0x7f0000000040)={'#! ', './file0', [{0x20, '/dev/zero\x00'}, {0x20, '/dev/zero\x00'}], 0xa, "d8ec39b17aaa34d8277681bf06c214c41e460f44a201ca49fc7fe3fa0719c88976ab64539e3169ad01aa712a0f619393d929280fee79b0e3db15c946c53af1f9aabe5839231e8aeb8ad2998d5f7be117767cd6a1e787a08ae10df5b578dd9cf3b548ac56cd20b06688d9c967b5a320591c54b7246199"}, 0x97) 02:23:40 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, 0x0, 0x0) 02:23:40 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b", 0xf) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 447.893994] binder_alloc: 23381: binder_alloc_buf size 4893816 failed, no address space [ 447.938025] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b", 0xf) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 447.979600] binder_alloc: binder_alloc_mmap_handler: 23381 20a00000-20e00000 already mapped failed -16 02:23:41 executing program 0: clone(0x2302001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x26) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x5, 0x20000000, 0xca}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 448.026156] binder: BINDER_SET_CONTEXT_MGR already set [ 448.062208] ptrace attach of "/root/syz-executor.0"[23398] was attempted by "/root/syz-executor.0"[23399] [ 448.078651] binder: 23381:23383 ioctl 40046207 0 returned -16 02:23:41 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:41 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:41 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 02:23:41 executing program 0: clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x15) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x20000003, 0x400000000, 0x135}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 02:23:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000480000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 448.227026] ptrace attach of "/root/syz-executor.0"[23412] was attempted by "/root/syz-executor.0"[23413] [ 448.237826] binder_alloc: 23409: binder_alloc_buf size 4893816 failed, no address space 02:23:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:41 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 448.276481] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 448.311324] binder_alloc: binder_alloc_mmap_handler: 23409 20a00000-20e00000 already mapped failed -16 02:23:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 448.364547] binder: BINDER_SET_CONTEXT_MGR already set [ 448.388034] binder: 23409:23410 ioctl 40046207 0 returned -16 [ 448.394681] binder_alloc: 23409: binder_alloc_buf, no vma 02:23:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000004c0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:41 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) socket$netlink(0x10, 0x3, 0xa) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r3, 0x0, r5, 0x0, 0x4010005, 0x0) [ 448.550967] binder_alloc: 23439: binder_alloc_buf size 4893816 failed, no address space [ 448.596742] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 448.629079] binder_alloc: binder_alloc_mmap_handler: 23439 20a00000-20e00000 already mapped failed -16 02:23:41 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:41 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 448.667115] binder: BINDER_SET_CONTEXT_MGR already set [ 448.667136] binder_alloc: 23439: binder_alloc_buf, no vma [ 448.680360] binder: 23439:23442 ioctl 40046207 0 returned -16 02:23:44 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) clone(0x2102801ff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00800000, 0x40000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0xea, 0xe2aa27f873a4c8d7, 0x0, 0x0, 0x0, 0x8}, 0x3c653c5cda5733bb) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) 02:23:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000600000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:44 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:44 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:44 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102801ff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00800000, 0x40000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0xea, 0xe2aa27f873a4c8d7, 0x0, 0x0, 0x0, 0x8}, 0x3c653c5cda5733bb) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) 02:23:44 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 451.262141] binder_alloc: 23468: binder_alloc_buf size 4893816 failed, no address space [ 451.279914] rpcbind: RPC call returned error 22 [ 451.293550] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 451.302767] binder_transaction: 12 callbacks suppressed 02:23:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 451.302784] binder: 23468:23469 transaction failed 29201/-28, size 4893815-0 line 3035 [ 451.379511] rpcbind: RPC call returned error 22 02:23:44 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) timerfd_create(0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) clone(0x2102801ff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00800000, 0x40000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0xea, 0xe2aa27f873a4c8d7, 0x0, 0x0, 0x0, 0x8}, 0x3c653c5cda5733bb) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) 02:23:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:44 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 451.428592] binder_alloc: binder_alloc_mmap_handler: 23468 20a00000-20e00000 already mapped failed -16 [ 451.523716] binder: BINDER_SET_CONTEXT_MGR already set [ 451.531764] binder: 23468:23469 ioctl 40046207 0 returned -16 [ 451.538657] rpcbind: RPC call returned error 22 [ 451.559541] rpcbind: RPC call returned error 22 [ 451.566595] binder_alloc: 23468: binder_alloc_buf, no vma 02:23:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 451.572174] binder: 23468:23496 transaction failed 29189/-3, size 4893815-0 line 3035 [ 451.614342] binder_release_work: 9 callbacks suppressed [ 451.614349] binder: undelivered TRANSACTION_ERROR: 29201 [ 451.644479] binder: undelivered TRANSACTION_ERROR: 29189 [ 454.997749] IPVS: ftp: loaded support on port[0] = 21 [ 455.120411] device bridge_slave_1 left promiscuous mode [ 455.126147] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.183858] device bridge_slave_0 left promiscuous mode [ 455.189297] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.147597] device hsr_slave_1 left promiscuous mode [ 458.188421] device hsr_slave_0 left promiscuous mode [ 458.256268] team0 (unregistering): Port device team_slave_1 removed [ 458.267960] team0 (unregistering): Port device team_slave_0 removed [ 458.277846] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 458.319847] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 458.417507] bond0 (unregistering): Released all slaves [ 458.508855] chnl_net:caif_netlink_parms(): no params data found [ 458.538144] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.544615] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.551414] device bridge_slave_0 entered promiscuous mode [ 458.558712] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.565183] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.571970] device bridge_slave_1 entered promiscuous mode [ 458.586503] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 458.595754] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 458.611555] team0: Port device team_slave_0 added [ 458.617850] team0: Port device team_slave_1 added [ 458.675761] device hsr_slave_0 entered promiscuous mode [ 458.723403] device hsr_slave_1 entered promiscuous mode [ 458.771990] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.778381] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.785056] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.791397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.822669] 8021q: adding VLAN 0 to HW filter on device bond0 [ 458.832773] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 458.841325] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.848534] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.856497] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 458.867235] 8021q: adding VLAN 0 to HW filter on device team0 [ 458.927341] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 458.935434] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.941786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.964794] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 458.972423] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.978856] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.987577] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 458.995878] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 459.010807] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 459.020862] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 459.032968] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 459.040945] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 459.048962] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 459.079621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 459.087013] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 459.130901] rpcbind: RPC call returned error 22 [ 459.144307] rpcbind: RPC call returned error 22 02:23:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:52 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:52 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000680000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:52 executing program 2: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)="5500000018007f1dfd0000b2a4a280930a80000000a84308910000000e0008000a000c00060000001940a30700000000000000001338d52f4400009bfb83de448daa7227c43ac9220000010cec4fab91d400000000", 0x55}], 0x1}, 0x0) [ 459.237568] netlink: 41 bytes leftover after parsing attributes in process `syz-executor.2'. [ 459.238988] binder_alloc: 23517: binder_alloc_buf size 4893816 failed, no address space [ 459.269933] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:52 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:52 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 459.297856] binder: 23517:23518 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:52 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xf, 0xe, &(0x7f0000000180)=ANY=[@ANYBLOB="85000000060000002408000000000000950000000000000075c6775881fe82b4ffef144394082ab2dff94b584173516d8613e3bed6c20474cac58027715e4e0000000038065335c3d69cd5c8b24dfdd1804e05feacdc75513b5ffd872afdb67a013ca0bb81f3fc6ebef6d23e2ac4000000000000"], 0x0, 0x1, 0x99, &(0x7f00000003c0)=""/153}, 0x48) 02:23:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 459.371065] binder_alloc: binder_alloc_mmap_handler: 23517 20a00000-20e00000 already mapped failed -16 02:23:52 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 459.416583] binder: BINDER_SET_CONTEXT_MGR already set [ 459.421994] binder: 23517:23518 ioctl 40046207 0 returned -16 02:23:52 executing program 2: r0 = socket$kcm(0xa, 0x2, 0x11) sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f0000000080)=@in6={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [0x300, 0x0, 0x2a0]}, 0xd}, 0x80, 0x0}, 0x0) 02:23:52 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:52 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 459.519188] binder_alloc: 23517: binder_alloc_buf, no vma [ 459.543519] binder: 23517:23545 transaction failed 29189/-3, size 4893815-0 line 3035 [ 459.614002] binder: undelivered TRANSACTION_ERROR: 29189 [ 459.620748] binder: undelivered TRANSACTION_ERROR: 29201 02:23:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000006c0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 459.827747] binder_alloc: 23559: binder_alloc_buf size 4893816 failed, no address space [ 459.849794] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 459.873307] binder: 23559:23560 transaction failed 29201/-28, size 4893815-0 line 3035 [ 459.889141] binder_alloc: binder_alloc_mmap_handler: 23559 20a00000-20e00000 already mapped failed -16 02:23:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:52 executing program 2: r0 = socket$kcm(0x10, 0x800000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="2e0000001c00810ee00f80ecdb4cb90402c804a003000000980010fb120001000e00da1b40d819a9060015000000", 0x2e}], 0x1}, 0x0) 02:23:52 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:52 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 459.920196] binder: BINDER_SET_CONTEXT_MGR already set 02:23:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000740000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:53 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 459.973561] binder: 23559:23560 ioctl 40046207 0 returned -16 [ 459.998148] binder: undelivered TRANSACTION_ERROR: 29201 02:23:53 executing program 2: socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000640)=[{0x0}], 0x1}, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='.yz1\xff', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x0, 0x0, 0x9a, 0x35c, 0x0, 0x2, 0x8000, 0x0, 0x0, 0x9, 0x1, 0x0, 0x4, 0x31d, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x2, 0x8, 0x0, 0x57, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x2, 0x5, @perf_bp={0x0, 0x1}, 0x1001, 0x0, 0x0, 0x0, 0x2, 0x8000}, 0xffffffffffffffff, 0x9, 0xffffffffffffffff, 0x3) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socket$kcm(0x29, 0x5, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x200000001, 0xa}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, 0x0, 0x0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r1, 0x0, 0x0}, 0x18) 02:23:53 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:53 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 460.124325] binder_alloc: 23576: binder_alloc_buf size 4893816 failed, no address space [ 460.132635] device lo entered promiscuous mode [ 460.160632] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:53 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:53 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 460.203424] binder: 23576:23580 transaction failed 29201/-28, size 4893815-0 line 3035 [ 460.231512] binder_alloc: binder_alloc_mmap_handler: 23576 20a00000-20e00000 already mapped failed -16 [ 460.268022] binder: BINDER_SET_CONTEXT_MGR already set 02:23:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) [ 460.294519] binder: 23576:23580 ioctl 40046207 0 returned -16 [ 460.300908] binder_alloc: 23576: binder_alloc_buf, no vma [ 460.312389] binder: 23576:23599 transaction failed 29189/-3, size 4893815-0 line 3035 [ 460.331195] binder: undelivered TRANSACTION_ERROR: 29201 [ 460.338019] binder: undelivered TRANSACTION_ERROR: 29189 02:23:53 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:53 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 02:23:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000004aac780000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:53 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 460.499918] binder_alloc: 23616: binder_alloc_buf size 4893816 failed, no address space [ 460.543425] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 460.570848] binder: 23616:23617 transaction failed 29201/-28, size 4893815-0 line 3035 [ 460.620038] binder_alloc: binder_alloc_mmap_handler: 23616 20a00000-20e00000 already mapped failed -16 [ 460.661645] binder: BINDER_SET_CONTEXT_MGR already set [ 460.673268] binder: 23616:23617 ioctl 40046207 0 returned -16 [ 460.679248] binder_alloc: 23616: binder_alloc_buf, no vma [ 460.711124] binder: undelivered TRANSACTION_ERROR: 29201 [ 460.714644] binder: 23616:23627 transaction failed 29189/-3, size 4893815-0 line 3035 [ 460.915265] binder: undelivered TRANSACTION_ERROR: 29189 02:23:54 executing program 2: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x400000004) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 02:23:54 executing program 0: ioctl(0xffffffffffffffff, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:54 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000007a0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 461.193567] binder_alloc: 23636: binder_alloc_buf size 4893816 failed, no address space 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:54 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:54 executing program 0: ioctl(0xffffffffffffffff, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 461.251390] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:54 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x1a, 0x0, 0x1d2) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1000000003c) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000040), 0x4) [ 461.325041] binder: 23636:23639 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:54 executing program 1: r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 461.371177] binder_alloc: binder_alloc_mmap_handler: 23636 20a00000-20e00000 already mapped failed -16 [ 461.411376] binder: BINDER_SET_CONTEXT_MGR already set 02:23:54 executing program 0: ioctl(0xffffffffffffffff, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 461.437240] binder: 23636:23639 ioctl 40046207 0 returned -16 [ 461.468768] binder: undelivered TRANSACTION_ERROR: 29201 02:23:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000fffffdfd0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:54 executing program 1: r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:54 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 461.629934] binder_alloc: 23683: binder_alloc_buf size 4893816 failed, no address space 02:23:54 executing program 1: r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 461.682004] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 461.729192] binder: 23683:23684 transaction failed 29201/-28, size 4893815-0 line 3035 [ 461.773032] binder_alloc: binder_alloc_mmap_handler: 23683 20a00000-20e00000 already mapped failed -16 [ 461.801505] binder: BINDER_SET_CONTEXT_MGR already set [ 461.823164] binder: 23683:23684 ioctl 40046207 0 returned -16 [ 461.834241] binder_alloc: 23683: binder_alloc_buf, no vma [ 461.851298] binder: undelivered TRANSACTION_ERROR: 29201 [ 461.857387] binder: 23683:23699 transaction failed 29189/-3, size 4893815-0 line 3035 [ 461.874476] binder: undelivered TRANSACTION_ERROR: 29189 02:23:54 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) clock_gettime(0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1a) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 02:23:54 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:54 executing program 1: connect$vsock_dgram(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000fdfdffff0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:55 executing program 3: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x0, 0x0, 0x0) [ 462.018510] binder_alloc: 23715: binder_alloc_buf size 4893816 failed, no address space 02:23:55 executing program 1: connect$vsock_dgram(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:55 executing program 0: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:55 executing program 3: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x0, 0x0, 0x0) 02:23:55 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 462.092031] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:55 executing program 3: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x0, 0x0, 0x0) [ 462.187494] binder_alloc: binder_alloc_mmap_handler: 23715 20a00000-20e00000 already mapped failed -16 [ 462.236264] binder: BINDER_SET_CONTEXT_MGR already set [ 462.261472] binder: 23715:23716 ioctl 40046207 0 returned -16 [ 462.286686] binder_alloc: 23715: binder_alloc_buf, no vma 02:23:55 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$swradio(0x0, 0xffffffffffffffff, 0x2) request_key(&(0x7f0000000000)='logon\x00', 0x0, 0x0, 0xfffffffffffffff8) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) clock_gettime(0x0, 0x0) ppoll(&(0x7f0000000180)=[{r0, 0x41a}], 0x1, &(0x7f0000000200), &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1a) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xffffffffffffff5d) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 02:23:55 executing program 1: connect$vsock_dgram(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:55 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:55 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x0, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000100000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:55 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 462.982917] binder_alloc: 23752: binder_alloc_buf size 4893816 failed, no address space [ 463.003335] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x0, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x0, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:56 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 463.092169] binder_alloc: binder_alloc_mmap_handler: 23752 20a00000-20e00000 already mapped failed -16 [ 463.156462] binder: BINDER_SET_CONTEXT_MGR already set 02:23:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 463.185482] binder: 23752:23756 ioctl 40046207 0 returned -16 [ 463.231596] binder_alloc: 23752: binder_alloc_buf, no vma 02:23:56 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$swradio(0x0, 0xffffffffffffffff, 0x2) request_key(&(0x7f0000000000)='logon\x00', 0x0, 0x0, 0xfffffffffffffff8) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) clock_gettime(0x0, 0x0) ppoll(&(0x7f0000000180)=[{r0, 0x41a}], 0x1, &(0x7f0000000200), &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1a) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, 0x0, 0xffffffffffffff5d) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 02:23:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x0, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, 0x0) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x0, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:56 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000200000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, 0x0) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 463.999801] binder_alloc: 23797: binder_alloc_buf size 4893816 failed, no address space 02:23:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:57 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, 0x0) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 464.057506] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x0, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 464.135123] binder_alloc: binder_alloc_mmap_handler: 23797 20a00000-20e00000 already mapped failed -16 [ 464.197563] binder: BINDER_SET_CONTEXT_MGR already set [ 464.231492] binder: 23797:23801 ioctl 40046207 0 returned -16 [ 464.267683] binder_alloc: 23797: binder_alloc_buf, no vma [ 464.309753] binder_transaction: 5 callbacks suppressed [ 464.309770] binder: 23797:23832 transaction failed 29189/-3, size 4893815-0 line 3035 02:23:57 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, 0x0) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, 0x0) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:57 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, 0x0) ppoll(&(0x7f0000000180)=[{r0, 0x41a}], 0x1, &(0x7f0000000200), &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1a) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 02:23:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000300000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:23:57 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 464.933853] binder_alloc: 23844: binder_alloc_buf size 4893816 failed, no address space [ 464.970619] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:58 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:23:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, 0x0) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 465.033610] binder: 23844:23845 transaction failed 29201/-28, size 4893815-0 line 3035 02:23:58 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 465.099424] binder: BINDER_SET_CONTEXT_MGR already set [ 465.112683] binder_alloc: binder_alloc_mmap_handler: 23844 20a00000-20e00000 already mapped failed -16 [ 465.114675] binder_alloc: 23844: binder_alloc_buf, no vma 02:23:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 465.188384] binder_release_work: 6 callbacks suppressed [ 465.188391] binder: undelivered TRANSACTION_ERROR: 29201 [ 465.195389] binder: 23844:23845 ioctl 40046207 0 returned -16 02:23:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:58 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 465.242203] binder: 23844:23864 transaction failed 29189/-3, size 4893815-0 line 3035 [ 465.303413] binder: undelivered TRANSACTION_ERROR: 29189 02:23:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:23:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:23:58 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)) syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:23:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000400000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:23:58 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 466.035297] binder_alloc: 23882: binder_alloc_buf size 4893816 failed, no address space [ 466.058841] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:23:59 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 466.084959] binder: 23882:23883 transaction failed 29201/-28, size 4893815-0 line 3035 [ 466.104716] binder_alloc: binder_alloc_mmap_handler: 23882 20a00000-20e00000 already mapped failed -16 [ 466.127467] binder: BINDER_SET_CONTEXT_MGR already set [ 466.141203] binder: 23882:23883 ioctl 40046207 0 returned -16 [ 466.154304] binder_alloc: 23882: binder_alloc_buf, no vma [ 466.164248] binder: 23882:23894 transaction failed 29189/-3, size 4893815-0 line 3035 [ 466.172562] binder: undelivered TRANSACTION_ERROR: 29201 [ 466.179574] binder: undelivered TRANSACTION_ERROR: 29189 [ 468.065485] IPVS: ftp: loaded support on port[0] = 21 [ 468.241459] device bridge_slave_1 left promiscuous mode [ 468.247192] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.293890] device bridge_slave_0 left promiscuous mode [ 468.299351] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.386044] device hsr_slave_1 left promiscuous mode [ 471.428428] device hsr_slave_0 left promiscuous mode [ 471.468637] team0 (unregistering): Port device team_slave_1 removed [ 471.479077] team0 (unregistering): Port device team_slave_0 removed [ 471.489635] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 471.528641] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 471.618916] bond0 (unregistering): Released all slaves [ 471.785850] chnl_net:caif_netlink_parms(): no params data found [ 471.813786] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.820242] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.827761] device bridge_slave_0 entered promiscuous mode [ 471.835090] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.841449] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.848713] device bridge_slave_1 entered promiscuous mode [ 471.862298] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 471.871595] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 471.889396] team0: Port device team_slave_0 added [ 471.895804] team0: Port device team_slave_1 added [ 471.954836] device hsr_slave_0 entered promiscuous mode [ 471.993482] device hsr_slave_1 entered promiscuous mode [ 472.065161] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.071553] bridge0: port 2(bridge_slave_1) entered forwarding state [ 472.078207] bridge0: port 1(bridge_slave_0) entered blocking state [ 472.084609] bridge0: port 1(bridge_slave_0) entered forwarding state [ 472.114452] 8021q: adding VLAN 0 to HW filter on device bond0 [ 472.126884] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 472.135176] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.141962] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.149641] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 472.195933] 8021q: adding VLAN 0 to HW filter on device team0 [ 472.206624] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 472.214619] bridge0: port 1(bridge_slave_0) entered blocking state [ 472.220974] bridge0: port 1(bridge_slave_0) entered forwarding state [ 472.238335] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 472.246391] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.252743] bridge0: port 2(bridge_slave_1) entered forwarding state [ 472.274064] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 472.284005] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 472.301671] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 472.310424] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 472.326705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 472.340028] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 472.358412] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 472.365409] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 472.374698] 8021q: adding VLAN 0 to HW filter on device batadv0 02:24:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000500000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:05 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c12") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 472.460344] binder_alloc: 23910: binder_alloc_buf size 4893816 failed, no address space 02:24:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c12") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 472.505186] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:05 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 472.572698] binder: 23910:23911 transaction failed 29201/-28, size 4893815-0 line 3035 [ 472.605831] binder_alloc: binder_alloc_mmap_handler: 23910 20a00000-20e00000 already mapped failed -16 [ 472.653559] binder: BINDER_SET_CONTEXT_MGR already set 02:24:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 472.683672] binder: 23910:23911 ioctl 40046207 0 returned -16 [ 472.714876] binder_alloc: 23910: binder_alloc_buf, no vma 02:24:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c12") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 472.752511] binder: 23910:23939 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000600000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:05 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 472.807687] binder: undelivered TRANSACTION_ERROR: 29201 [ 472.829610] binder: undelivered TRANSACTION_ERROR: 29189 02:24:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 472.934457] binder_alloc: 23966: binder_alloc_buf size 4893816 failed, no address space [ 472.942748] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:24:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, 0x0, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:06 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 473.129347] binder: 23966:23967 transaction failed 29201/-28, size 4893815-0 line 3035 [ 473.177890] binder_alloc: binder_alloc_mmap_handler: 23966 20a00000-20e00000 already mapped failed -16 [ 473.233031] binder: BINDER_SET_CONTEXT_MGR already set [ 473.252035] binder_alloc: 23966: binder_alloc_buf, no vma [ 473.270464] binder: 23966:23993 ioctl 40046207 0 returned -16 [ 473.273830] binder: undelivered TRANSACTION_ERROR: 29201 02:24:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000700000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:24:06 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, 0x0, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:06 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, 0x0, 0x0) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 473.280868] binder: 23966:23994 transaction failed 29189/-3, size 4893815-0 line 3035 [ 473.303305] binder: undelivered TRANSACTION_ERROR: 29189 02:24:06 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:06 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 473.390750] binder_alloc: 24008: binder_alloc_buf size 4893816 failed, no address space [ 473.423383] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(0xffffffffffffffff, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b0") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 473.538031] binder: 24008:24010 transaction failed 29201/-28, size 4893815-0 line 3035 [ 473.589341] binder_alloc: binder_alloc_mmap_handler: 24008 20a00000-20e00000 already mapped failed -16 [ 473.627129] binder: BINDER_SET_CONTEXT_MGR already set [ 473.632503] binder: 24008:24010 ioctl 40046207 0 returned -16 [ 473.660742] binder_alloc: 24008: binder_alloc_buf, no vma [ 473.694123] binder: undelivered TRANSACTION_ERROR: 29201 [ 473.700761] binder: 24008:24031 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000a00000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(0xffffffffffffffff, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:06 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:06 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b0") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(0xffffffffffffffff, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 473.733520] binder: undelivered TRANSACTION_ERROR: 29189 02:24:06 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:06 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b0") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 473.820686] binder_alloc: 24046: binder_alloc_buf size 4893816 failed, no address space 02:24:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b0") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x11, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 473.902836] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 473.962156] binder: 24046:24047 transaction failed 29201/-28, size 4893815-0 line 3035 [ 474.003397] binder_alloc: binder_alloc_mmap_handler: 24046 20a00000-20e00000 already mapped failed -16 [ 474.013689] binder: BINDER_SET_CONTEXT_MGR already set [ 474.058985] binder_alloc: 24046: binder_alloc_buf, no vma [ 474.090668] binder: undelivered TRANSACTION_ERROR: 29201 [ 474.096673] binder: 24046:24047 ioctl 40046207 0 returned -16 02:24:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000001200000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b0") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:07 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:07 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x0, 0x0, 0x0) [ 474.121451] binder: 24046:24063 transaction failed 29189/-3, size 4893815-0 line 3035 [ 474.130083] binder: undelivered TRANSACTION_ERROR: 29189 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:07 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:07 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b0") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x0, 0x0, 0x0) [ 474.308350] binder_alloc: 24085: binder_alloc_buf size 4893816 failed, no address space 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 474.374718] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 474.442669] binder: 24085:24089 transaction failed 29201/-28, size 4893815-0 line 3035 [ 474.471296] binder_alloc: binder_alloc_mmap_handler: 24085 20a00000-20e00000 already mapped failed -16 02:24:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000002000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:07 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:07 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x0, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x0, 0x0, 0x0) [ 474.516588] binder: BINDER_SET_CONTEXT_MGR already set [ 474.521905] binder: 24085:24089 ioctl 40046207 0 returned -16 [ 474.524714] binder_alloc: 24085: binder_alloc_buf, no vma [ 474.541309] binder: 24085:24111 transaction failed 29189/-3, size 4893815-0 line 3035 [ 474.550788] binder: undelivered TRANSACTION_ERROR: 29201 [ 474.559062] binder: undelivered TRANSACTION_ERROR: 29189 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x0, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 474.672148] binder_alloc: 24125: binder_alloc_buf size 4893816 failed, no address space 02:24:07 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x0, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:07 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) [ 474.712650] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 474.827882] binder_alloc: binder_alloc_mmap_handler: 24125 20a00000-20e00000 already mapped failed -16 [ 474.871545] binder: BINDER_SET_CONTEXT_MGR already set 02:24:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000003f00000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(0xffffffffffffffff, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:07 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x0, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 02:24:07 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:07 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x0, 0x4, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 474.900032] binder: 24125:24126 ioctl 40046207 0 returned -16 [ 474.931682] binder_alloc: 24125: binder_alloc_buf, no vma 02:24:07 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:08 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") syz_emit_ethernet(0x211d49, &(0x7f0000000000)={@local, @empty=[0x80fe, 0x7, 0x0, 0x300], [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300003, 0x0, 0x0, @ipv4={[0x2], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x29], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 475.025117] binder_alloc: 24160: binder_alloc_buf size 4893816 failed, no address space 02:24:08 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 02:24:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x0, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 475.093319] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:08 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 475.188725] binder_alloc: binder_alloc_mmap_handler: 24160 20a00000-20e00000 already mapped failed -16 [ 475.239047] binder: BINDER_SET_CONTEXT_MGR already set [ 475.291184] binder: 24160:24163 ioctl 40046207 0 returned -16 [ 475.298399] binder_alloc: 24160: binder_alloc_buf, no vma 02:24:08 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 02:24:08 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000004800000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x0, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:08 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x1, 0x3, 0xc}, 0x3cf) 02:24:08 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:08 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 02:24:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x0, 0x1b, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:08 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:08 executing program 0: [ 475.446332] binder_alloc: 24200: binder_alloc_buf size 4893816 failed, no address space [ 475.533357] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:08 executing program 0: [ 475.588996] binder_alloc: binder_alloc_mmap_handler: 24200 20a00000-20e00000 already mapped failed -16 02:24:08 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 475.634540] binder: BINDER_SET_CONTEXT_MGR already set [ 475.639844] binder: 24200:24201 ioctl 40046207 0 returned -16 [ 475.676678] binder_alloc: 24200: binder_alloc_buf, no vma 02:24:08 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:08 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80), 0x0, 0x0, 0x0) 02:24:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:08 executing program 0: 02:24:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000004c00000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:08 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 475.912695] binder_alloc: 24229: binder_alloc_buf size 4893816 failed, no address space 02:24:08 executing program 0: 02:24:08 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x6, 0x4, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:09 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80), 0x0, 0x0, 0x0) 02:24:09 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 475.963790] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 476.027327] binder_alloc: binder_alloc_mmap_handler: 24229 20a00000-20e00000 already mapped failed -16 [ 476.090783] binder: BINDER_SET_CONTEXT_MGR already set 02:24:09 executing program 0: 02:24:09 executing program 2: [ 476.111282] binder: 24229:24230 ioctl 40046207 0 returned -16 [ 476.132231] binder_alloc: 24229: binder_alloc_buf, no vma 02:24:09 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:09 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80), 0x0, 0x0, 0x0) 02:24:09 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x0, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000006000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:09 executing program 0: syz_open_dev$admmidi(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_THP_DISABLE(0x29, 0x0) getsockname(0xffffffffffffffff, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000480)={0x0, @in={{0x2, 0x4e21, @remote}}, 0x0, 0x0, 0x0, 0x4, 0x21}, 0x98) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @broadcast}}, 0xffff}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x98) 02:24:09 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) [ 476.442536] binder_alloc: 24264: binder_alloc_buf size 4893816 failed, no address space [ 476.453465] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:09 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x0, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 476.513314] binder_alloc: binder_alloc_mmap_handler: 24264 20a00000-20e00000 already mapped failed -16 [ 476.551052] binder: BINDER_SET_CONTEXT_MGR already set 02:24:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 02:24:09 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 476.614665] binder: 24264:24265 ioctl 40046207 0 returned -16 02:24:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000006800000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:09 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 476.767724] binder: BINDER_SET_CONTEXT_MGR already set [ 476.773076] binder: 24292:24293 ioctl 40046207 0 returned -16 [ 476.787009] binder_alloc: 24292: binder_alloc_buf, no vma 02:24:09 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x0, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:10 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(0x0, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000006c00000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:10 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 02:24:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x4c, 0x0, &(0x7f0000000600)=[@acquire, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x4c, 0x0, &(0x7f0000000600)=[@acquire, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 477.116822] binder: BINDER_SET_CONTEXT_MGR already set [ 477.116830] binder: 24307:24308 got transaction to context manager from process owning it 02:24:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)}}], 0x1, 0x0, 0x0) [ 477.200757] binder: 24312:24313 ioctl 40046207 0 returned -16 [ 477.200901] binder: send failed reply for transaction 1296 to 24307:24308 [ 477.227656] binder: 24325:24328 got transaction to context manager from process owning it [ 477.239661] binder: BINDER_SET_CONTEXT_MGR already set 02:24:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 477.277123] binder: 24312:24322 ioctl 40046207 0 returned -16 [ 477.277925] binder_thread_release: 2 callbacks suppressed [ 477.277935] binder: release 24325:24328 transaction 1305 out, still active [ 477.303315] binder: unexpected work type, 4, not freed [ 477.322042] binder_release_work: 2 callbacks suppressed 02:24:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)}}], 0x1, 0x0, 0x0) [ 477.322047] binder: undelivered TRANSACTION_COMPLETE [ 477.386383] binder_send_failed_reply: 2 callbacks suppressed [ 477.386391] binder: send failed reply for transaction 1305, target dead [ 477.435825] binder: undelivered TRANSACTION_COMPLETE 02:24:10 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(0x0, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000007400000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)}}], 0x1, 0x0, 0x0) 02:24:10 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140), 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 477.567238] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 477.567248] binder_alloc: 24345: binder_alloc_buf size 4893816 failed, no address space 02:24:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) [ 477.621861] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 477.621877] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 477.640680] binder: release 24348:24351 transaction 1314 out, still active 02:24:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000005c0)={0x4c, 0x0, &(0x7f0000000600)=[@acquire, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:24:10 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140), 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 477.670550] binder_transaction: 21 callbacks suppressed [ 477.670568] binder: 24345:24346 transaction failed 29201/-28, size 4893815-0 line 3035 [ 477.701781] binder: unexpected work type, 4, not freed 02:24:10 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x3001}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000e00)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x504) [ 477.728022] binder: undelivered TRANSACTION_COMPLETE [ 477.744971] binder: release 24352:24353 transaction 1315 out, still active [ 477.766609] binder: unexpected work type, 4, not freed 02:24:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) 02:24:10 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140), 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 477.772828] binder_alloc_mmap_handler: 3 callbacks suppressed [ 477.772844] binder_alloc: binder_alloc_mmap_handler: 24345 20a00000-20e00000 already mapped failed -16 [ 477.793385] binder: BINDER_SET_CONTEXT_MGR already set [ 477.800971] binder: undelivered TRANSACTION_COMPLETE [ 477.813300] binder: 24366:24368 ioctl 40046207 0 returned -16 [ 477.828005] binder: BINDER_SET_CONTEXT_MGR already set [ 477.847300] binder: 24345:24346 ioctl 40046207 0 returned -16 [ 477.853741] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 477.853748] binder_alloc: 24345: binder_alloc_buf, no vma [ 477.873050] binder: 24366:24368 transaction failed 29189/-3, size 24-8 line 3035 [ 477.881382] binder_alloc: 24345: binder_alloc_buf, no vma [ 477.904714] binder: 24345:24375 transaction failed 29189/-3, size 4893815-0 line 3035 [ 477.928798] binder_release_work: 22 callbacks suppressed [ 477.928805] binder: undelivered TRANSACTION_ERROR: 29201 [ 477.945102] binder: send failed reply for transaction 1314, target dead [ 477.981594] binder: 24366:24368 Acquire 1 refcount change on invalid ref 0 ret -22 [ 478.006947] binder: 24366:24368 transaction failed 29189/-22, size 0-0 line 2896 [ 478.007460] binder: send failed reply for transaction 1315, target dead [ 478.041282] binder: undelivered TRANSACTION_ERROR: 29189 [ 478.057709] binder: undelivered TRANSACTION_ERROR: 29189 02:24:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(0x0, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) 02:24:11 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}}], 0x1, 0x0, 0x0) 02:24:11 executing program 2: r0 = socket$kcm(0x2, 0x400000805, 0x0) sendmsg$kcm(r0, &(0x7f0000000740)={&(0x7f0000000640)=@in={0x2, 0x0, @dev}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000200)="ff", 0x1}], 0x1}, 0x0) 02:24:11 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000004aac7800000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:11 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40286608, 0x20000001) [ 478.092785] binder: undelivered TRANSACTION_ERROR: 29189 [ 478.153951] binder_alloc: 24385: binder_alloc_buf size 4893816 failed, no address space 02:24:11 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000001c0)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='1M'], 0x2) 02:24:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) 02:24:11 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 478.198410] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:11 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) flock(r1, 0x1) flock(r0, 0x2) exit_group(0x0) flock(r1, 0xfffffffffffffffd) 02:24:11 executing program 0: setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000100)=ANY=[@ANYBLOB="73656375726974790000000000000000000000000000010000000000000000000e00000004000000480300002801000000000000280100002801"], 0x1) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0xf) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="591402d07701000000cd8fbc162c4d8524e04aba6397600900000056efc427482e7d3691c700cd3edfa7afe309000000000000000000000000"], 0x39) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:24:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) [ 478.303003] binder: 24385:24386 transaction failed 29201/-28, size 4893815-0 line 3035 [ 478.308164] kernel msg: ebtables bug: please report to author: target size too small [ 478.336388] binder_alloc: binder_alloc_mmap_handler: 24385 20a00000-20e00000 already mapped failed -16 [ 478.366730] binder: BINDER_SET_CONTEXT_MGR already set [ 478.372282] ptrace attach of "/root/syz-executor.0"[24418] was attempted by "/root/syz-executor.0"[24419] [ 478.392939] binder: 24385:24386 ioctl 40046207 0 returned -16 [ 478.405368] binder_alloc: 24385: binder_alloc_buf, no vma [ 478.431246] binder: undelivered TRANSACTION_ERROR: 29201 [ 478.437439] binder: 24385:24414 transaction failed 29189/-3, size 4893815-0 line 3035 [ 478.464468] binder: undelivered TRANSACTION_ERROR: 29189 [ 478.474937] kernel msg: ebtables bug: please report to author: target size too small 02:24:11 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:11 executing program 0: socketpair$unix(0x1, 0x80005, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f00000001c0)='\x00\x00\x06\x00j\x94d\x89\xe2\xba\xedY\xcaE\xdc\x131\x83\x9ep\xa0AG\x8e\'q\x10\x1e\\\xa9?\xec\xbb\xd4\xf0\x9a\xbb\x84;\xbc\x1c\x1e\x19i\x11[\xc0\xca\xb0.6/3\xf43r\xbd\xff\xb8\xa6\xf7\xc0\xf8\t]\x16\xc6\xed=[\x99\n\xce\xf0;%c\x92?\x1f\xd8\xf9\xd8\xe9\x19[NfM\x82\xce\xe9\xb7\xf0fwS\x92\r\xc2\x87\x97\xb69\x0eO\x16\xb5\xb0;W\xc0c\x0e\x06~>F\xc2,\x97 \xabW\xc6\x9d\xb2\x9a\x9c;(*\x1f\xd2\xd7\x06\xe7\xb5\xebd\x85\x16\xa6\x9eP\x95\xf8\xfbl|/\xbc\xfa\"\x82.\x14\xbb\xa7\x9e\x06\x94\x922\x92U\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x1) clone(0x2102001ff8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r1, &(0x7f0000000100)='\x00', 0x0, 0x0, 0x1000) 02:24:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 02:24:11 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) signalfd(0xffffffffffffffff, &(0x7f00007aeff8), 0x8) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000180)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x40006100) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400204) ioctl$int_in(r1, 0x5421, &(0x7f0000000140)) ftruncate(r2, 0x208200) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r4, 0x0) getsockopt$packet_buf(r1, 0x107, 0x17, &(0x7f0000000400)=""/175, &(0x7f00000004c0)=0xaf) futex(0x0, 0x0, 0x0, &(0x7f0000003ff0), 0x0, 0x0) getsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, 0x0, &(0x7f00000076c0)) r5 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f00000001c0)={{0x11, @local, 0x4e21, 0x0, 'lblcr\x00', 0x18, 0x800, 0x57}, {@multicast1, 0x4e23, 0x2001, 0x0, 0x4, 0x5}}, 0x44) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000500)="1a5ccea55d86975089a960e3871af2986e60a1f748c37b639b6f9a2f08c3879e6fe811d06a035f86d4cd2c4fa33f7434e7ce34666d176d52050b1156081f6bbd03b8f66fc95b0293641ac66f977951a54caba8a95a96d41dcffe95819528b35ec4fa8a297ea3f9d826d9a4a652d16ca5aaa614859bca44d6addb4bd4bf54349f5875d28320ab6abf9d4790975c30ed49832daebf463b2c53fb2b7419fd404b65ddb4afb3f21031575e3f10c5007a44a6e1b3af4063f43daab2950f4c46f14412a331cca3f16949c557e8a189e13b51378b51ab222a3c8570a9e8c14f8bb0069a00278c15") unshare(0x20020000) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000040)='minix\x00', 0x0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000002c0)='ramfs\x00\xd9q\xab\xafP\xe5,h:\xc7\x926\'\xa5tL\xd7\xd1\xb9k\x8dF\x18\xe2N6\x04\x9bXD\xa7_\xe6\xf6\xd4 \v\x96\xb0t\x9f\xdd\x17\xfc\r\x8cQf?i\xb7\x89\x99\xdf\xf0\n\xd5\xd5\xf2\xa5\x94\x05y\xd3\x18\x9b\xfa\x01\xa1\xfe5|\xac\xc0Jw\xd5\xeb\xfe2\xe5\xb2uG\xa1\xe8\xd9\x06\x9fS\x81Ii\xfcE\x1b\x92#\xe7G\xc9\xd9r\xa8\xc2\xfb\x93\xbb#\xf6\xa8\xa42a\xfa3\xfc\xbf\xbePq\xcfH\x00+%\xfa\xbc\x80;\xd3\xe5,\xc1\n\x1b\xce\x00\xc7\xe3\xbfC\x0f\xb3B+\x8a2\x19\xed\xd9\x13\xfc\xe8\x9dV\xb7\xf1\xdf\'\xa4lc\xaa\xcdi\xc9\xa1\x18G1\xca\x15.R\x87\t\xdf\xe5\xf7\xcd\xd5\xf5\xa8xL\x82\x89l\xc9\xa0g\a4\x88\xf4\xfd\x1d>\xc0\xc3\xaf\xf2h_\xcf\xd3\xe2+\xd6#\x11\xfb\'yr{\xf1\x0f\xa2EU', 0x0, 0x0) poll(0x0, 0x0, 0x400007f) rename(&(0x7f0000000300)='./file1\x00', &(0x7f0000000340)='./file0\x00') sendfile(r2, r5, 0x0, 0x8000fffffffe) clock_gettime(0x0, &(0x7f0000000240)) 02:24:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) 02:24:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000007a00000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 478.619829] binder_alloc: 24433: binder_alloc_buf size 4893816 failed, no address space [ 478.620605] kernel msg: ebtables bug: please report to author: target size too small [ 478.654172] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) 02:24:11 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7fffffff}) 02:24:11 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, 0x0, 0x0, 0x0) [ 478.663954] binder: 24433:24435 transaction failed 29201/-28, size 4893815-0 line 3035 [ 478.717268] binder_alloc: binder_alloc_mmap_handler: 24433 20a00000-20e00000 already mapped failed -16 [ 478.749880] kernel msg: ebtables bug: please report to author: target size too small 02:24:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 478.774701] binder: BINDER_SET_CONTEXT_MGR already set 02:24:11 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, 0x0, 0x0, 0x0) 02:24:11 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000280)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='veth1\x00', 0xb) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x6, 0x7f}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000013, &(0x7f0000000140), 0x27b) sendto(r0, &(0x7f0000000300)="d0", 0x1, 0x0, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f00000003c0)={'syz1'}, 0x4) sendto(r0, &(0x7f0000000100)="06", 0x1, 0x0, 0x0, 0x0) [ 478.802249] binder: 24433:24435 ioctl 40046207 0 returned -16 [ 478.841884] binder_alloc: 24433: binder_alloc_buf, no vma 02:24:11 executing program 0: getpid() perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="39000000140081ae00002c000500018708546fabca1b4e7d06a6580e883795c0c54c1960b89c40ebb37358582bdbb7d553b4a421556b3d5df5", 0x39}], 0x1}, 0x0) 02:24:11 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 478.859613] kernel msg: ebtables bug: please report to author: target size too small [ 478.883553] binder: undelivered TRANSACTION_ERROR: 29201 [ 478.889442] binder: 24433:24463 transaction failed 29189/-3, size 4893815-0 line 3035 [ 478.929121] binder: undelivered TRANSACTION_ERROR: 29189 02:24:12 executing program 5: 02:24:12 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:12 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, 0x0, 0x0, 0x0) 02:24:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000fffffdfd00000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:12 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="2e0000002800813ee45ae087184a82cf0400b0eba06ec40000230000a022bd322be5e6adcef60000000051894dd6", 0x2e}], 0x1}, 0x0) 02:24:12 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 02:24:12 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 479.509099] binder_alloc: 24486: binder_alloc_buf size 4893816 failed, no address space [ 479.538682] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:12 executing program 5: 02:24:12 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}], 0x1, 0x0) 02:24:12 executing program 0: 02:24:12 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 479.572325] binder: 24486:24489 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:12 executing program 5: [ 479.635556] binder_alloc: binder_alloc_mmap_handler: 24486 20a00000-20e00000 already mapped failed -16 [ 479.683439] binder: BINDER_SET_CONTEXT_MGR already set 02:24:12 executing program 0: 02:24:12 executing program 5: 02:24:12 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}], 0x1, 0x0) [ 479.706648] binder: 24486:24489 ioctl 40046207 0 returned -16 [ 479.740092] kernel msg: ebtables bug: please report to author: target size too small [ 479.748794] binder_alloc: 24486: binder_alloc_buf, no vma [ 479.787907] binder: 24486:24518 transaction failed 29189/-3, size 4893815-0 line 3035 [ 479.829476] binder: undelivered TRANSACTION_ERROR: 29201 [ 479.838365] binder: undelivered TRANSACTION_ERROR: 29189 02:24:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000200000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:12 executing program 5: 02:24:13 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) nanosleep(&(0x7f0000000000)={0x0, 0x1c9c380}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) 02:24:13 executing program 0: 02:24:13 executing program 5: 02:24:13 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}], 0x1, 0x0) 02:24:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 479.995001] binder_alloc: 24530: binder_alloc_buf size 4893816 failed, no address space [ 480.010204] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 480.021529] binder_alloc: binder_alloc_mmap_handler: 24530 20a00000-20e00000 already mapped failed -16 02:24:13 executing program 5: [ 480.076731] kernel msg: ebtables bug: please report to author: target size too small [ 480.085155] binder: BINDER_SET_CONTEXT_MGR already set [ 480.092784] binder: 24530:24531 ioctl 40046207 0 returned -16 02:24:13 executing program 0: 02:24:13 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}}], 0x2, 0x0) [ 480.127739] binder_alloc: 24530: binder_alloc_buf, no vma 02:24:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:13 executing program 5: 02:24:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000300000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:13 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000140)=[@mss, @mss, @window, @sack_perm], 0x1bf) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bc070") socket$packet(0x11, 0x0, 0x300) socket$packet(0x11, 0x0, 0x300) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080), 0x4) [ 480.256912] kernel msg: ebtables bug: please report to author: target size too small [ 480.307300] binder_alloc: 24558: binder_alloc_buf size 4893816 failed, no address space [ 480.366519] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 480.398877] binder_alloc: binder_alloc_mmap_handler: 24558 20a00000-20e00000 already mapped failed -16 02:24:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:13 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}}], 0x2, 0x0) 02:24:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x10006, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0xfffffffffffffffc, 0x1, 0x993a, 0x0, 0xffffffffffffffff, 0x9}, 0x2c) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000240)={0x0, 0x70, 0x2, 0x0, 0x4, 0x4, 0x0, 0xfffffffffffffffa, 0x1040c, 0x4, 0x9, 0x2, 0x7, 0x3f, 0x1000, 0x727b, 0x3f, 0x800000000000000, 0xbe, 0x6, 0x8001, 0x3, 0x4, 0x401, 0x8, 0x7fff, 0x0, 0x6, 0x3, 0x51a, 0x3, 0x4, 0xaf99, 0x3, 0x9, 0x8, 0x401, 0x4, 0x0, 0x5f, 0x0, @perf_config_ext={0xff, 0x6}, 0x100c2, 0x0, 0xffffffff, 0x7, 0xf3, 0x0, 0x4}) r0 = socket$kcm(0x2, 0x3, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='pids.events\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x6, 0x3ff, 0x2, 0x4, 0x81a, r2, 0x80000000}, 0x259) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000c40)='cpu&5\n\n\n\x00\x00\x01\x00\x00\x03\x9c\xd3\x0e5\xcc\xa0\x1d=\v\n\x1c`fo\x8d\xccm\\v\xfd.\x9e\tbk1\xde\xea\x1b\r;\x81\x84\x87-X\xb6,\xc5\xb4\"7&\xb5yt\x82\xfb\x1d\x83\xe6\xf8.-m\n\xf3\xb1(\xe9`D\x01i\\\x8dl\x86lh\xa8\xfc\x80\xde,Kt\xf4\x1a\xc5]Y;\t\x06\xbe*\xaa&\xbd\x16xQ\x86\xf3\xd6\x1a\xfd\xd0\x04\'y\x9b|\xe4\xb7\bE\xed\x97\x80s\x19W\xb7[\xf0%>MM\xf5\x98\xbe^=q!\xa6\x0fp\x012\x00\xbb\xbe\x9dr5\xafep\x10R\v&\xaf\xa8$\x7f7V\xedLJ4\xcf\x90@\xd5T\n\xca\xc2\x86_\xc1\xce\x8d\xedbS\x8d\xe9t\x82\xf41zwr\xe6o\x88\xe5\xe3\xe7Gcx\xc0\x91I\x8d\xfd\xe4\xbbs\xbf\n\x00K\x9e\xe5[\xa0\n\x0f\x04\xa6\xb0sE)\x8a\xd0R\xc3\xc1,b \x1c#IRz6\xfeJ~\xda\xd7_\xbe\x1f\xe5\x86\xb1x\x00\x00\x00\x00\x00\x00\x00\x00\x93\xab\x05') ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x4) r3 = socket$kcm(0xa, 0x40122000000003, 0x11) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000840)={r0}) openat$cgroup_ro(r2, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) write$cgroup_pid(r4, &(0x7f0000000100), 0xda4fff08) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff94, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x660c, 0x0) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)=0xffffffffffffffff, 0xfffffffffffffde3) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x404000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r5) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:24:13 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close(r0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_GET_TUNSRC(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)}, 0x0) 02:24:13 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0x99, &(0x7f0000000180)=""/153}, 0x48) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000004c0)={0xffffffffffffffff, r0}, 0x10) [ 480.436117] binder_alloc: 24558: binder_alloc_buf, no vma [ 480.441941] binder: BINDER_SET_CONTEXT_MGR already set [ 480.459654] binder: 24558:24559 ioctl 40046207 0 returned -16 02:24:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000400000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 480.526549] kernel msg: ebtables bug: please report to author: target size too small [ 480.585510] binder_alloc: 24578: binder_alloc_buf size 4893816 failed, no address space 02:24:13 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}}], 0x2, 0x0) 02:24:13 executing program 0: pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$TIOCEXCL(r0, 0x540c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, 0x0, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000280)=0xff, 0x4) sendmmsg(r1, &(0x7f00000002c0), 0x4000000000000ce, 0x0) [ 480.637156] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 480.664688] kernel msg: ebtables bug: please report to author: target size too small 02:24:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:13 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) shutdown(r1, 0x1) syz_emit_ethernet(0x66, &(0x7f0000000100)={@link_local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30, 0x0, 0x0, @ipv4={[0x3580], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff80, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 480.695582] binder_alloc: binder_alloc_mmap_handler: 24578 20a00000-20e00000 already mapped failed -16 02:24:13 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, &(0x7f0000000040)}}], 0x2, 0x0) [ 480.784818] kernel msg: ebtables bug: please report to author: target size too small [ 480.794198] binder: BINDER_SET_CONTEXT_MGR already set [ 480.816732] binder: 24578:24579 ioctl 40046207 0 returned -16 [ 480.839642] binder_alloc: 24578: binder_alloc_buf, no vma 02:24:13 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000500000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 480.975903] kernel msg: ebtables bug: please report to author: target size too small [ 481.029754] binder_alloc: 24674: binder_alloc_buf size 4893816 failed, no address space [ 481.051336] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 481.106791] binder_alloc: binder_alloc_mmap_handler: 24674 20a00000-20e00000 already mapped failed -16 [ 481.151882] binder: BINDER_SET_CONTEXT_MGR already set [ 481.162046] binder: 24674:24689 ioctl 40046207 0 returned -16 [ 481.177878] binder_alloc: 24674: binder_alloc_buf, no vma 02:24:14 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000080)={{0x1, 0x0, 0x0, 0x0, 0xb55}}) 02:24:14 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, &(0x7f0000000040)}}], 0x2, 0x0) 02:24:14 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:14 executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) pipe(0x0) r1 = dup(r0) write$9p(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000280)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @loopback, 0x8}, 0x80000000}, 0x5c) 02:24:14 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x10006, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0xfffffffffffffffc, 0x1, 0x993a, 0x0, 0xffffffffffffffff, 0x9}, 0x2c) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000240)={0x0, 0x70, 0x2, 0x0, 0x4, 0x4, 0x0, 0xfffffffffffffffa, 0x1040c, 0x4, 0x9, 0x2, 0x7, 0x3f, 0x1000, 0x727b, 0x3f, 0x800000000000000, 0xbe, 0x6, 0x8001, 0x3, 0x4, 0x401, 0x8, 0x7fff, 0x0, 0x6, 0x3, 0x51a, 0x3, 0x4, 0xaf99, 0x3, 0x9, 0x8, 0x401, 0x4, 0x0, 0x5f, 0x0, @perf_config_ext={0xff, 0x6}, 0x100c2, 0x0, 0xffffffff, 0x7, 0xf3, 0x0, 0x4}) r0 = socket$kcm(0x2, 0x3, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='pids.events\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x6, 0x3ff, 0x2, 0x4, 0x81a, r2, 0x80000000}, 0x259) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000c40)='cpu&5\n\n\n\x00\x00\x01\x00\x00\x03\x9c\xd3\x0e5\xcc\xa0\x1d=\v\n\x1c`fo\x8d\xccm\\v\xfd.\x9e\tbk1\xde\xea\x1b\r;\x81\x84\x87-X\xb6,\xc5\xb4\"7&\xb5yt\x82\xfb\x1d\x83\xe6\xf8.-m\n\xf3\xb1(\xe9`D\x01i\\\x8dl\x86lh\xa8\xfc\x80\xde,Kt\xf4\x1a\xc5]Y;\t\x06\xbe*\xaa&\xbd\x16xQ\x86\xf3\xd6\x1a\xfd\xd0\x04\'y\x9b|\xe4\xb7\bE\xed\x97\x80s\x19W\xb7[\xf0%>MM\xf5\x98\xbe^=q!\xa6\x0fp\x012\x00\xbb\xbe\x9dr5\xafep\x10R\v&\xaf\xa8$\x7f7V\xedLJ4\xcf\x90@\xd5T\n\xca\xc2\x86_\xc1\xce\x8d\xedbS\x8d\xe9t\x82\xf41zwr\xe6o\x88\xe5\xe3\xe7Gcx\xc0\x91I\x8d\xfd\xe4\xbbs\xbf\n\x00K\x9e\xe5[\xa0\n\x0f\x04\xa6\xb0sE)\x8a\xd0R\xc3\xc1,b \x1c#IRz6\xfeJ~\xda\xd7_\xbe\x1f\xe5\x86\xb1x\x00\x00\x00\x00\x00\x00\x00\x00\x93\xab\x05') ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x4) r3 = socket$kcm(0xa, 0x40122000000003, 0x11) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000840)={r0}) openat$cgroup_ro(r2, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) write$cgroup_pid(r4, &(0x7f0000000100), 0xda4fff08) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff94, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x660c, 0x0) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)=0xffffffffffffffff, 0xfffffffffffffde3) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x404000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r5) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:24:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000600000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 481.431306] kernel msg: ebtables bug: please report to author: target size too small [ 481.455283] binder_alloc: 24735: binder_alloc_buf size 4893816 failed, no address space 02:24:14 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x10006, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0xfffffffffffffffc, 0x1, 0x993a, 0x0, 0xffffffffffffffff, 0x9}, 0x2c) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000240)={0x0, 0x70, 0x2, 0x0, 0x4, 0x4, 0x0, 0xfffffffffffffffa, 0x1040c, 0x4, 0x9, 0x2, 0x7, 0x3f, 0x1000, 0x727b, 0x3f, 0x800000000000000, 0xbe, 0x6, 0x8001, 0x3, 0x4, 0x401, 0x8, 0x7fff, 0x0, 0x6, 0x3, 0x51a, 0x3, 0x4, 0xaf99, 0x3, 0x9, 0x8, 0x401, 0x4, 0x0, 0x5f, 0x0, @perf_config_ext={0xff, 0x6}, 0x100c2, 0x0, 0xffffffff, 0x7, 0xf3, 0x0, 0x4}) r0 = socket$kcm(0x2, 0x3, 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000100)='pids.events\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x6, 0x3ff, 0x2, 0x4, 0x81a, r2, 0x80000000}, 0x259) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000c40)='cpu&5\n\n\n\x00\x00\x01\x00\x00\x03\x9c\xd3\x0e5\xcc\xa0\x1d=\v\n\x1c`fo\x8d\xccm\\v\xfd.\x9e\tbk1\xde\xea\x1b\r;\x81\x84\x87-X\xb6,\xc5\xb4\"7&\xb5yt\x82\xfb\x1d\x83\xe6\xf8.-m\n\xf3\xb1(\xe9`D\x01i\\\x8dl\x86lh\xa8\xfc\x80\xde,Kt\xf4\x1a\xc5]Y;\t\x06\xbe*\xaa&\xbd\x16xQ\x86\xf3\xd6\x1a\xfd\xd0\x04\'y\x9b|\xe4\xb7\bE\xed\x97\x80s\x19W\xb7[\xf0%>MM\xf5\x98\xbe^=q!\xa6\x0fp\x012\x00\xbb\xbe\x9dr5\xafep\x10R\v&\xaf\xa8$\x7f7V\xedLJ4\xcf\x90@\xd5T\n\xca\xc2\x86_\xc1\xce\x8d\xedbS\x8d\xe9t\x82\xf41zwr\xe6o\x88\xe5\xe3\xe7Gcx\xc0\x91I\x8d\xfd\xe4\xbbs\xbf\n\x00K\x9e\xe5[\xa0\n\x0f\x04\xa6\xb0sE)\x8a\xd0R\xc3\xc1,b \x1c#IRz6\xfeJ~\xda\xd7_\xbe\x1f\xe5\x86\xb1x\x00\x00\x00\x00\x00\x00\x00\x00\x93\xab\x05') ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x4) r3 = socket$kcm(0xa, 0x40122000000003, 0x11) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000840)={r0}) openat$cgroup_ro(r2, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) write$cgroup_pid(r4, &(0x7f0000000100), 0xda4fff08) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff94, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x660c, 0x0) r5 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)=0xffffffffffffffff, 0xfffffffffffffde3) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x404000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r5) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:24:14 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:14 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000001640)={'syzkaller1\x00', 0x401}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'gretap0\x00', 0x400}) [ 481.492053] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:14 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, &(0x7f0000000040)}}], 0x2, 0x0) [ 481.551314] binder_alloc: binder_alloc_mmap_handler: 24735 20a00000-20e00000 already mapped failed -16 [ 481.597233] binder: BINDER_SET_CONTEXT_MGR already set [ 481.610044] kernel msg: ebtables bug: please report to author: target size too small 02:24:14 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 481.639981] binder: 24735:24737 ioctl 40046207 0 returned -16 02:24:14 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000140)}}], 0x1, 0x0) [ 481.715949] binder_alloc: 24735: binder_alloc_buf, no vma [ 481.730479] kernel msg: ebtables bug: please report to author: target size too small 02:24:14 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:14 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0105502, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}) 02:24:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000700000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:14 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000140)}}], 0x1, 0x0) [ 481.891669] kernel msg: ebtables bug: please report to author: target size too small [ 481.973624] binder_alloc: 24775: binder_alloc_buf size 4893816 failed, no address space [ 482.044719] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 482.115475] binder_alloc: binder_alloc_mmap_handler: 24775 20a00000-20e00000 already mapped failed -16 [ 482.170633] binder: BINDER_SET_CONTEXT_MGR already set [ 482.197256] binder: 24775:24776 ioctl 40046207 0 returned -16 02:24:15 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x80003, 0x3) recvmmsg(r0, &(0x7f00000004c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 02:24:15 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:15 executing program 3: 02:24:15 executing program 0: r0 = timerfd_create(0x1, 0x80000) fcntl$setown(r0, 0x8, 0x0) 02:24:15 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000140)}}], 0x1, 0x0) 02:24:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000a00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:15 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 482.416531] kernel msg: ebtables bug: please report to author: target size too small 02:24:15 executing program 0: [ 482.480078] cgroup: fork rejected by pids controller in /syz2 [ 482.507081] binder: BINDER_SET_CONTEXT_MGR already set [ 482.512674] kernel msg: ebtables bug: please report to author: target size too small 02:24:15 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:15 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000140)}}], 0x2, 0x0) [ 482.545765] binder: 24794:24798 ioctl 40046207 0 returned -16 02:24:15 executing program 3: 02:24:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000001200000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 482.643681] kernel msg: ebtables bug: please report to author: target size too small [ 482.702744] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 482.702753] binder_alloc: 24815: binder_alloc_buf size 4893816 failed, no address space [ 482.723826] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 482.723842] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 482.745387] binder_transaction: 14 callbacks suppressed [ 482.745404] binder: 24815:24816 transaction failed 29201/-28, size 4893815-0 line 3035 [ 482.766720] binder: BINDER_SET_CONTEXT_MGR already set [ 482.772130] binder: 24815:24816 ioctl 40046207 0 returned -16 [ 482.778600] binder: 24815:24819 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:16 executing program 5: 02:24:16 executing program 0: 02:24:16 executing program 2: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:16 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000140)}}], 0x2, 0x0) 02:24:16 executing program 3: 02:24:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000004800000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 483.305313] kernel msg: ebtables bug: please report to author: target size too small [ 483.329118] binder_alloc: 24828: binder_alloc_buf size 4893816 failed, no address space 02:24:16 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = socket$netlink(0x10, 0x3, 0x0) recvmmsg(r1, &(0x7f0000002d80), 0x400000000000368, 0x1a002, &(0x7f0000000180)={0x77359400}) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000042000501010000000000000000d3902ffd4cd47ca788bb000000090000008b0f9fc81724c7280822a0ad8acf413b7d4f53d00aa5ff27d1e3f3a51fc5a9aefcb6824a1958f3ff941827c3c58385020438f64a8a78162e27ea9c508c971534fa3df000ea619260b80fd589a9a52c3739ad071d0c7c8f57e5dc9a047eef9b37b03e5fb7ad18adc715503259dc0bd05005fdec5a520fa46e897b34ee632fad1da29a8a669aa7e23d832b3a66ec2c2633fc922c57820fb9919218596ea48e482bb43642568c6387dd8923bcbf8a27fb0079844a0c18421e"], 0x1}}, 0x0) 02:24:16 executing program 3: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000004c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x4, [{{0xa, 0x4e21, 0x400, @loopback, 0x1}}, {{0xa, 0x4e21, 0x3, @remote, 0x2}}, {{0xa, 0x4e20, 0x9, @mcast1, 0x5}}, {{0xa, 0x0, 0x0, @loopback}}]}, 0x290) 02:24:16 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000140)}}], 0x2, 0x0) 02:24:16 executing program 2: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:16 executing program 5: socketpair$unix(0x1, 0x80005, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000040)='\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00', 0x0) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c4600000000000012000000000003003e00000000000000000400000000400000000000000000000035570007ef0000c914f53b380002000000ffff000003000000"], 0x44) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) clone(0x2102001ff8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$P9_RREAD(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="9200df00750200870000007939d94fbeda73c435e3d44b05a96f947e6fad6e0cc76ec14a0cc5ebcad142403c7bacd90181980867ab180fe09cbb8201db3497bbe9de17b9e3aa61c1db3a4b4d52aded956efb0002ace0feb2db09efd424bdcc289bafadfb73af6d79c3c6c1fa"], 0x6c) execveat(r1, &(0x7f0000000100)='\x00', 0x0, 0x0, 0x1000) [ 483.365104] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 483.393665] binder: 24828:24831 transaction failed 29201/-28, size 4893815-0 line 3035 [ 483.427903] binder_alloc_mmap_handler: 2 callbacks suppressed [ 483.427933] binder_alloc: binder_alloc_mmap_handler: 24828 20a00000-20e00000 already mapped failed -16 [ 483.472722] kernel msg: ebtables bug: please report to author: target size too small 02:24:16 executing program 2: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:16 executing program 1: r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000700)='syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffa0008000, 0x0, 0x0, 0x0, 0x0}, 0x28) sendmsg(0xffffffffffffffff, &(0x7f0000002a80)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_int(r1, &(0x7f0000000940)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, 0x0, 0x0}, 0x20) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x1, 0x0) write$cgroup_int(r2, 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x3001}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000006c0)={0xffffffffffffffff, 0x0, 0x0}, 0x18) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000e00)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x504) 02:24:16 executing program 3: socketpair$unix(0x1, 0x80000000002, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) getpid() perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[@ANYRES16=0x0], 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 02:24:16 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x82be, 0x5b, &(0x7f0000000100)=""/91, 0x41000, 0x1, [], 0x0, 0x9}, 0x48) r0 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x14, &(0x7f0000000080), 0x301) [ 483.517150] binder: BINDER_SET_CONTEXT_MGR already set [ 483.532849] binder: 24828:24831 ioctl 40046207 0 returned -16 [ 483.550949] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 483.550984] binder_alloc: 24828: binder_alloc_buf, no vma [ 483.629219] kernel msg: ebtables bug: please report to author: target size too small [ 483.645333] binder_release_work: 16 callbacks suppressed [ 483.645340] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.650753] binder: 24828:24868 transaction failed 29189/-3, size 4893815-0 line 3035 [ 483.672596] binder: undelivered TRANSACTION_ERROR: 29189 02:24:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0xffffffffffffff26, &(0x7f0000000140)) socket$inet6(0xa, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, 0x0, 0x400, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000000)={0x2, 0x10001}) ioctl$DRM_IOCTL_AGP_INFO(0xffffffffffffffff, 0x80386433, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg(r3, 0x0, 0x4000) sendmsg(0xffffffffffffffff, 0x0, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000100)="460f300f07c483614804ee08440f20c03506000000440f22c0c402f93473230f09f20f013cb9b805000000b9c00000000f01d90fc728c4c1f9e79f2e000000", 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x0) 02:24:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000004c00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:16 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000140)=0x100) [ 483.798696] binder_alloc: 24892: binder_alloc_buf size 4893816 failed, no address space [ 483.841152] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 483.862346] binder: 24892:24893 transaction failed 29201/-28, size 4893815-0 line 3035 [ 483.887975] binder_alloc: binder_alloc_mmap_handler: 24892 20a00000-20e00000 already mapped failed -16 [ 483.902787] binder: BINDER_SET_CONTEXT_MGR already set [ 483.908450] binder: 24892:24893 ioctl 40046207 0 returned -16 [ 483.914894] binder_alloc: 24892: binder_alloc_buf, no vma [ 483.920462] binder: 24892:24903 transaction failed 29189/-3, size 4893815-0 line 3035 [ 483.928940] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.943331] binder: undelivered TRANSACTION_ERROR: 29189 02:24:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) connect$inet(r0, 0x0, 0x0) r1 = socket$inet(0x2, 0x3, 0x7) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f0000000300)={0x1, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @broadcast}}}, 0x108) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @rand_addr=0x8000, @remote}, 0xc) 02:24:17 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:17 executing program 0: clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x3, 0x1, 0x13d}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 02:24:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000006000000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:17 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x9, 0xd, 0x209e1e, 0x9, 0x2}, 0x2c) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x13) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 02:24:17 executing program 3: munmap(&(0x7f0000551000/0x2000)=nil, 0x2000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x8, &(0x7f0000000240)='posix_acl_accesswlan0keyring/nodev#*md5sumcgroup\x00') r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x2000203a, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000300)=""/246) utime(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$EVIOCGREP(r0, 0x40047459, &(0x7f0000000240)=""/174) read(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) rt_sigpending(&(0x7f00000012c0), 0x8) r1 = syz_open_dev$rtc(&(0x7f0000001180)='/dev/rtc#\x00', 0x2, 0x20002) write(r1, &(0x7f00000011c0)="f10000", 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd33b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) semget(0x0, 0x3, 0x40) stat(&(0x7f0000000040)='./file0\x00', 0x0) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000100)) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000400)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000440)) r2 = add_key$keyring(&(0x7f00000019c0)='keyring\x00', &(0x7f0000001a00)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) request_key(&(0x7f0000001380)='asymmetric\x00', 0x0, &(0x7f0000001940)='eql\x00', r2) unshare(0x40000000) write$FUSE_STATFS(r0, 0x0, 0x0) [ 484.304514] kernel msg: ebtables bug: please report to author: target size too small [ 484.321306] binder_alloc: 25009: binder_alloc_buf size 4893816 failed, no address space 02:24:17 executing program 1: 02:24:17 executing program 5: 02:24:17 executing program 0: 02:24:17 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 484.351014] IPVS: ftp: loaded support on port[0] = 21 [ 484.357390] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 484.379078] binder: 25009:25016 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:17 executing program 5: [ 484.421530] binder_alloc: binder_alloc_mmap_handler: 25009 20a00000-20e00000 already mapped failed -16 [ 484.433613] binder: BINDER_SET_CONTEXT_MGR already set [ 484.457256] binder: 25009:25016 ioctl 40046207 0 returned -16 02:24:17 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:17 executing program 5: [ 484.479947] kernel msg: ebtables bug: please report to author: target size too small [ 484.486538] binder: undelivered TRANSACTION_ERROR: 29201 02:24:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000006800000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:17 executing program 1: 02:24:17 executing program 0: [ 484.614009] binder_alloc: 25043: binder_alloc_buf size 4893816 failed, no address space [ 484.627053] kernel msg: ebtables bug: please report to author: target size too small [ 484.664060] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 484.678281] binder: 25043:25044 transaction failed 29201/-28, size 4893815-0 line 3035 [ 484.720084] IPVS: ftp: loaded support on port[0] = 21 [ 484.739587] binder_alloc: binder_alloc_mmap_handler: 25043 20a00000-20e00000 already mapped failed -16 [ 484.749213] binder: BINDER_SET_CONTEXT_MGR already set [ 484.755989] binder: 25043:25044 ioctl 40046207 0 returned -16 [ 484.762122] binder_alloc: 25043: binder_alloc_buf, no vma [ 484.767837] binder: 25043:25051 transaction failed 29189/-3, size 4893815-0 line 3035 [ 484.768020] binder: undelivered TRANSACTION_ERROR: 29201 [ 484.785323] binder: undelivered TRANSACTION_ERROR: 29189 02:24:17 executing program 3: 02:24:17 executing program 5: 02:24:17 executing program 0: 02:24:17 executing program 1: 02:24:17 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000006c00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:17 executing program 1: 02:24:17 executing program 5: 02:24:17 executing program 0: [ 484.886784] binder_alloc: 25053: binder_alloc_buf size 4893816 failed, no address space [ 484.907114] kernel msg: ebtables bug: please report to author: target size too small [ 484.927518] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:17 executing program 3: [ 484.981398] binder: 25053:25058 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:18 executing program 1: 02:24:18 executing program 5: 02:24:18 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 485.042994] binder_alloc: binder_alloc_mmap_handler: 25053 20a00000-20e00000 already mapped failed -16 02:24:18 executing program 3: [ 485.085611] binder: BINDER_SET_CONTEXT_MGR already set 02:24:18 executing program 0: [ 485.146758] kernel msg: ebtables bug: please report to author: target size too small [ 485.166770] binder: 25053:25058 ioctl 40046207 0 returned -16 02:24:18 executing program 1: 02:24:18 executing program 5: [ 485.197147] binder_alloc: 25053: binder_alloc_buf, no vma [ 485.222686] binder: undelivered TRANSACTION_ERROR: 29201 [ 485.239195] binder: undelivered TRANSACTION_ERROR: 29189 02:24:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000007400000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:18 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:18 executing program 0: 02:24:18 executing program 5: 02:24:18 executing program 3: 02:24:18 executing program 1: [ 485.354161] kernel msg: ebtables bug: please report to author: target size too small 02:24:18 executing program 0: 02:24:18 executing program 3: 02:24:18 executing program 5: [ 485.417100] binder_alloc: 25096: binder_alloc_buf size 4893816 failed, no address space 02:24:18 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:18 executing program 1: [ 485.493065] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:18 executing program 3: [ 485.549124] binder_alloc: binder_alloc_mmap_handler: 25096 20a00000-20e00000 already mapped failed -16 [ 485.634520] binder: BINDER_SET_CONTEXT_MGR already set [ 485.640126] binder_alloc: 25096: binder_alloc_buf, no vma [ 485.661824] binder: 25096:25098 ioctl 40046207 0 returned -16 02:24:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000007a00000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:18 executing program 5: r0 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f0000000480), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376862f68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7", 0x28}], 0x1}, 0x0) 02:24:18 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6ead, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:24:18 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r1, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0xfffffffffffffffd) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x5) 02:24:18 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x0, 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000080)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}) [ 485.733500] binder: undelivered TRANSACTION_ERROR: 29189 02:24:18 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x24}]}, &(0x7f0000000100)='GPL\x00'}, 0x48) 02:24:18 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6ead, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r1, 0x0) 02:24:18 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_THP_DISABLE(0x29, 0x0) getsockname(0xffffffffffffffff, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000240), 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x98) [ 485.884581] binder_alloc: 25127: binder_alloc_buf size 4893816 failed, no address space 02:24:18 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x40, 0x8000) ioctl$RTC_WIE_ON(r0, 0x700f) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(0xffffffffffffffff, 0x28, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, 0x0, 0x0) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x2) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_THP_DISABLE(0x29, 0x0) getsockname(0xffffffffffffffff, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000240)={0x0, 0x9}, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000480)={r4, @in={{0x2, 0x4e21, @remote}}, 0xdfa0000000000000, 0x0, 0x8000, 0x4, 0x21}, 0x98) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x3, 0x4, [0x0, 0x1000, 0x3, 0xcb8b]}, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @broadcast}}, 0xffff, 0x7}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r3, r0}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x98) [ 485.954213] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 486.024234] binder_alloc: binder_alloc_mmap_handler: 25127 20a00000-20e00000 already mapped failed -16 [ 486.101774] binder: BINDER_SET_CONTEXT_MGR already set [ 486.107186] binder: 25127:25197 ioctl 40046207 0 returned -16 [ 486.124276] binder_alloc: 25127: binder_alloc_buf, no vma [ 489.191739] IPVS: ftp: loaded support on port[0] = 21 [ 489.449040] chnl_net:caif_netlink_parms(): no params data found [ 489.475951] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.482396] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.489410] device bridge_slave_0 entered promiscuous mode [ 489.623874] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.630259] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.637681] device bridge_slave_1 entered promiscuous mode [ 489.654978] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 489.669764] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 489.746481] IPVS: ftp: loaded support on port[0] = 21 [ 489.852191] team0: Port device team_slave_0 added [ 489.859894] team0: Port device team_slave_1 added [ 490.056111] device hsr_slave_0 entered promiscuous mode [ 490.093459] device hsr_slave_1 entered promiscuous mode [ 490.160955] device bridge_slave_1 left promiscuous mode [ 490.168869] bridge0: port 2(bridge_slave_1) entered disabled state [ 490.233996] device bridge_slave_0 left promiscuous mode [ 490.239502] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.576231] device hsr_slave_1 left promiscuous mode [ 493.639260] device hsr_slave_0 left promiscuous mode [ 493.698083] team0 (unregistering): Port device team_slave_1 removed [ 493.708944] team0 (unregistering): Port device team_slave_0 removed [ 493.720547] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 493.767695] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 493.870633] bond0 (unregistering): Released all slaves [ 494.028259] chnl_net:caif_netlink_parms(): no params data found [ 494.066403] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.072813] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.079878] device bridge_slave_0 entered promiscuous mode [ 494.090216] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.097682] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.108201] device bridge_slave_1 entered promiscuous mode [ 494.137941] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 494.147800] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 494.168985] team0: Port device team_slave_0 added [ 494.176315] team0: Port device team_slave_1 added [ 494.234736] device hsr_slave_0 entered promiscuous mode [ 494.286715] device hsr_slave_1 entered promiscuous mode [ 494.431390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 494.451539] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.457943] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.464711] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.471067] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.484837] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.494284] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.501719] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.513979] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 494.521022] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 494.529743] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 494.538061] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 494.546182] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.552527] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.583440] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 494.590592] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 494.599502] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 494.607475] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.613867] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.622191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 494.630182] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 494.638459] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 494.646797] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 494.671672] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 494.682539] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 494.694656] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 494.701791] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 494.710825] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 494.719903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 494.729815] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 494.743116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 494.752911] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 494.775768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 494.787741] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 494.800700] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 494.814340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 494.826857] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.886562] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 494.897084] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.903548] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.918587] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 494.929115] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.935523] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.975388] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 494.984446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 494.992342] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 495.000622] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 495.010488] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 495.018754] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 495.071960] 8021q: adding VLAN 0 to HW filter on device batadv0 02:24:28 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:28 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000040), 0x0, 0x2}, 0x20) 02:24:28 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000003000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3, 0x0, 0xffffffffffffffff, 0x0, [0x15]}, 0x2c) [ 495.255320] kernel msg: ebtables bug: please report to author: target size too small [ 495.325493] binder_alloc: 25264: binder_alloc_buf size 4893816 failed, no address space 02:24:28 executing program 1: getresuid(&(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, 0x0) chown(&(0x7f0000000080)='./file0\x00', r0, 0x0) 02:24:28 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 495.390445] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 495.427091] binder_transaction: 5 callbacks suppressed [ 495.427124] binder: 25264:25265 transaction failed 29201/-28, size 4893815-0 line 3035 [ 495.508127] kernel msg: ebtables bug: please report to author: target size too small 02:24:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3, 0x0, 0xffffffffffffffff, 0x0, [0x15]}, 0x2c) [ 495.554638] binder_alloc: binder_alloc_mmap_handler: 25264 20a00000-20e00000 already mapped failed -16 02:24:28 executing program 1: 02:24:28 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:28 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 495.636005] binder: BINDER_SET_CONTEXT_MGR already set [ 495.690809] binder: 25264:25265 ioctl 40046207 0 returned -16 [ 495.727141] binder_alloc: 25264: binder_alloc_buf, no vma [ 495.750509] binder_release_work: 3 callbacks suppressed [ 495.750516] binder: undelivered TRANSACTION_ERROR: 29201 [ 495.775274] binder: 25264:25291 transaction failed 29189/-3, size 4893815-0 line 3035 [ 495.795015] kernel msg: ebtables bug: please report to author: target size too small [ 495.853327] binder: undelivered TRANSACTION_ERROR: 29189 02:24:29 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x40, 0x8000) ioctl$RTC_WIE_ON(r0, 0x700f) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(0xffffffffffffffff, 0x28, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, 0x0, 0x0) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x2) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_THP_DISABLE(0x29, 0x0) getsockname(0xffffffffffffffff, 0x0, 0x0) r3 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000240)={0x0, 0x9}, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000480)={r4, @in={{0x2, 0x4e21, @remote}}, 0xdfa0000000000000, 0x0, 0x8000, 0x4, 0x21}, 0x98) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x3, 0x4, [0x0, 0x1000, 0x3, 0xcb8b]}, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @broadcast}}, 0xffff, 0x7}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r3, r0}) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x98) 02:24:29 executing program 1: 02:24:29 executing program 5: 02:24:29 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000005000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:29 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:29 executing program 5: 02:24:29 executing program 1: [ 496.060606] binder_alloc: 25305: binder_alloc_buf size 4893816 failed, no address space 02:24:29 executing program 0: bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x18) 02:24:29 executing program 5: [ 496.157250] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:29 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 496.204576] binder: 25305:25307 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:29 executing program 1: [ 496.284601] binder_alloc: binder_alloc_mmap_handler: 25305 20a00000-20e00000 already mapped failed -16 [ 496.350118] binder_alloc: 25305: binder_alloc_buf, no vma [ 496.369826] binder: BINDER_SET_CONTEXT_MGR already set [ 496.375578] binder: 25305:25330 transaction failed 29189/-3, size 4893815-0 line 3035 [ 496.412447] binder: 25305:25335 ioctl 40046207 0 returned -16 [ 496.414229] binder: undelivered TRANSACTION_ERROR: 29201 [ 496.522794] binder: undelivered TRANSACTION_ERROR: 29189 02:24:29 executing program 3: 02:24:29 executing program 5: 02:24:29 executing program 0: bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x18) 02:24:29 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:29 executing program 1: 02:24:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000006000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:29 executing program 1: [ 496.797904] binder_alloc: 25345: binder_alloc_buf size 4893816 failed, no address space 02:24:29 executing program 5: 02:24:29 executing program 3: 02:24:29 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:29 executing program 0: bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x18) [ 496.903723] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:29 executing program 1: 02:24:30 executing program 5: [ 496.960759] binder: 25345:25348 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:30 executing program 3: [ 497.013015] binder_alloc: binder_alloc_mmap_handler: 25345 20a00000-20e00000 already mapped failed -16 02:24:30 executing program 0: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:30 executing program 5: [ 497.093364] binder: BINDER_SET_CONTEXT_MGR already set [ 497.098816] binder: 25345:25348 ioctl 40046207 0 returned -16 [ 497.143981] binder_alloc: 25345: binder_alloc_buf, no vma [ 497.190233] binder: undelivered TRANSACTION_ERROR: 29201 [ 497.230944] binder: 25345:25382 transaction failed 29189/-3, size 4893815-0 line 3035 [ 497.245716] binder: undelivered TRANSACTION_ERROR: 29189 02:24:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000007000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:30 executing program 1: 02:24:30 executing program 3: 02:24:30 executing program 0: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:30 executing program 5: 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:30 executing program 0: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:30 executing program 1: 02:24:30 executing program 3: 02:24:30 executing program 5: 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 497.472183] binder_alloc: 25399: binder_alloc_buf size 4893816 failed, no address space [ 497.553346] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 497.592303] binder: 25399:25406 transaction failed 29201/-28, size 4893815-0 line 3035 [ 497.635275] binder_alloc: binder_alloc_mmap_handler: 25399 20a00000-20e00000 already mapped failed -16 [ 497.663358] binder: BINDER_SET_CONTEXT_MGR already set [ 497.668656] binder: 25399:25406 ioctl 40046207 0 returned -16 02:24:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000a000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:30 executing program 1: 02:24:30 executing program 3: syz_execute_func(&(0x7f00000002c0)="3666440f50f564ff0941c3c4e2c9975842c4c27d794e0066420fe2e33e0f1110c442019dccd3196f") clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) creat(&(0x7f00000004c0)='./file1\x00', 0x6a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) execve(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r2 = open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x1003fd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) write$binfmt_misc(r2, &(0x7f0000000140)={'syz1'}, 0x4) 02:24:30 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:30 executing program 5: clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) futex(&(0x7f0000000040)=0x2, 0x0, 0x2, &(0x7f0000000100)={0x0, 0x1c9c380}, 0x0, 0x0) socket(0xa, 0x0, 0x0) 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 497.693285] binder_alloc: 25399: binder_alloc_buf, no vma [ 497.698862] binder: 25399:25422 transaction failed 29189/-3, size 4893815-0 line 3035 [ 497.707085] binder: undelivered TRANSACTION_ERROR: 29201 [ 497.723337] binder: undelivered TRANSACTION_ERROR: 29189 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, 0x0, 0x258) 02:24:30 executing program 1: 02:24:30 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 497.854734] binder_alloc: 25438: binder_alloc_buf size 4893816 failed, no address space 02:24:30 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, 0x0, 0x258) [ 497.896509] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:30 executing program 1: 02:24:30 executing program 5: [ 497.947926] binder: 25438:25441 transaction failed 29201/-28, size 4893815-0 line 3035 [ 498.019519] binder_alloc: binder_alloc_mmap_handler: 25438 20a00000-20e00000 already mapped failed -16 [ 498.060527] binder: BINDER_SET_CONTEXT_MGR already set [ 498.080739] binder: 25438:25441 ioctl 40046207 0 returned -16 02:24:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000012000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:31 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:31 executing program 1: 02:24:31 executing program 3: socketpair(0x1, 0x20001000000005, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) socket$kcm(0x2, 0xa, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8916, &(0x7f0000000200)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x02\x00\xdc\xff\xa0\x00\x80\x00\x00\x00\x02?\xfa\xf3W\x14\xf9\x92N2\xde\xf8\xff\tj\xf3\xb8\xb4\xd2\xaf\x99\x97r\xe1v\xb2]W\xe4\xc3\xd9\xa7\xa4 \x90\x87\xa4\x1c#\x14\xa2\xee\xd0\xe3vY\xbc1\xdff4\x93O\xc6`%P\\c\xe7`;V\xfc7\xec\xd9,[\xc2\xeaL\xceg&\x1e7\xb9,\xe4\xf79i\xe2\xad\xf9\xf2\x85Z\x85\x15\xd8I&\x9e}\xeb\xb1\xa6Zf\x11\xf6\x01y\xe2\xcb\xa6\x95R\xaa\xff-\xfcU\x1c\x85\x9f\x8d\xc17l\xa5\xb9\xca\x9ej\xcf\xeeW') 02:24:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, 0x0, 0x258) 02:24:31 executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x2, 0x3, &(0x7f0000000540)=@framed, &(0x7f0000000580)='GPL\x00', 0x8000, 0xfd, &(0x7f00000005c0)=""/253}, 0x48) close(r0) [ 498.157486] binder_alloc: 25438: binder_alloc_buf, no vma [ 498.163078] binder: 25438:25469 transaction failed 29189/-3, size 4893815-0 line 3035 [ 498.182846] binder: undelivered TRANSACTION_ERROR: 29201 [ 498.193406] binder: undelivered TRANSACTION_ERROR: 29189 02:24:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1e, 0x0, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) close(0xffffffffffffffff) perf_event_open(&(0x7f0000000380)={0x2, 0x70, 0x13, 0x8000000000000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) [ 498.243591] syz-executor.3 uses obsolete (PF_INET,SOCK_PACKET) 02:24:31 executing program 5: setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000100)=ANY=[@ANYBLOB="73656375726974790000000000000000000000000000010000000000000000000e00000004000000480300002801000000000000280100002801"], 0x1) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="190002d07701000000cd8fbcf184c8080100bc1d002e489c162c4d4456e04aba6397600900000056efc427482e7d36a4c700cd3edfa7afe309"], 0x39) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:24:31 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x0, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 498.312755] binder_alloc: 25482: binder_alloc_buf size 4893816 failed, no address space [ 498.352727] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 498.365277] kernel msg: ebtables bug: please report to author: bad policy [ 498.379309] binder_alloc: binder_alloc_mmap_handler: 25482 20a00000-20e00000 already mapped failed -16 02:24:31 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x0, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 498.421105] binder: BINDER_SET_CONTEXT_MGR already set [ 498.436030] binder: 25482:25483 ioctl 40046207 0 returned -16 [ 498.449369] binder_alloc: 25482: binder_alloc_buf, no vma 02:24:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000020000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:31 executing program 1: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="19ce781d481a09005ba59f4d48fdedc4ae4d14f8302808f5f10a00f1019cbe7900a2abd7614bc3239db8e06101ad303c7b221310e2f2d2df53"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x1f, r0, 0x0, 0x0) 02:24:31 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x0, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 498.613011] binder_alloc: 25515: binder_alloc_buf size 4893816 failed, no address space [ 498.629754] kernel msg: ebtables bug: please report to author: bad policy [ 498.638440] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 498.666314] binder_alloc: binder_alloc_mmap_handler: 25515 20a00000-20e00000 already mapped failed -16 [ 498.688861] binder: BINDER_SET_CONTEXT_MGR already set [ 498.699257] binder: 25515:25517 ioctl 40046207 0 returned -16 [ 498.703339] binder_alloc: 25515: binder_alloc_buf, no vma 02:24:31 executing program 3: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000003a0001ffff00000000b910a62e000000"], 0x1}}, 0x0) 02:24:31 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x0, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:31 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000003f000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:31 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 498.826012] kernel msg: ebtables bug: please report to author: bad policy [ 498.843163] binder_alloc: 25528: binder_alloc_buf size 4893816 failed, no address space [ 498.851507] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 498.904663] binder_alloc: binder_alloc_mmap_handler: 25528 20a00000-20e00000 already mapped failed -16 [ 498.916793] binder: BINDER_SET_CONTEXT_MGR already set [ 498.930186] binder: 25528:25533 ioctl 40046207 0 returned -16 [ 498.939701] binder_alloc: 25528: binder_alloc_buf, no vma 02:24:34 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) 02:24:34 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aba000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000aca000), 0x0) 02:24:34 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000048000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:34 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:34 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x0, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:34 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) 02:24:34 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 501.409143] binder_alloc: 25546: binder_alloc_buf size 4893816 failed, no address space [ 501.419976] kernel msg: ebtables bug: please report to author: Wrong len argument [ 501.447746] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:34 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x0, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:34 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x77d548254afe2ed9) recvmsg(r0, &(0x7f00000007c0)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, 0x0}, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) writev(r1, 0x0, 0x0) [ 501.489482] binder_transaction: 6 callbacks suppressed [ 501.501141] binder: 25546:25553 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:34 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) 02:24:34 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:34 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 501.542342] kernel msg: ebtables bug: please report to author: Wrong len argument [ 501.580063] binder_alloc: binder_alloc_mmap_handler: 25546 20a00000-20e00000 already mapped failed -16 [ 501.613669] binder_alloc: 25546: binder_alloc_buf, no vma [ 501.619410] binder: 25546:25571 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:34 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 501.667409] binder_release_work: 6 callbacks suppressed [ 501.667417] binder: undelivered TRANSACTION_ERROR: 29201 [ 501.679715] binder: BINDER_SET_CONTEXT_MGR already set 02:24:34 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) [ 501.723695] kernel msg: ebtables bug: please report to author: Wrong len argument [ 501.763397] binder: 25546:25553 ioctl 40046207 0 returned -16 [ 501.769630] binder: undelivered TRANSACTION_ERROR: 29189 02:24:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000004c000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:34 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:34 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) 02:24:34 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:34 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:34 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 501.864874] kernel msg: ebtables bug: please report to author: bad policy [ 501.913695] binder_alloc: 25606: binder_alloc_buf size 4893816 failed, no address space [ 501.964486] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 501.979041] kernel msg: ebtables bug: please report to author: bad policy [ 501.992699] binder: 25606:25607 transaction failed 29201/-28, size 4893815-0 line 3035 [ 502.012270] binder_alloc: binder_alloc_mmap_handler: 25606 20a00000-20e00000 already mapped failed -16 [ 502.022172] binder: BINDER_SET_CONTEXT_MGR already set [ 502.027667] binder: 25606:25607 ioctl 40046207 0 returned -16 [ 502.033958] binder_alloc: 25606: binder_alloc_buf, no vma [ 502.039619] binder: 25606:25614 transaction failed 29189/-3, size 4893815-0 line 3035 [ 502.047912] binder: undelivered TRANSACTION_ERROR: 29201 [ 502.054366] binder: undelivered TRANSACTION_ERROR: 29189 02:24:35 executing program 5: r0 = inotify_init1(0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = inotify_add_watch(r0, &(0x7f00000000c0)='.\x00', 0x20000000) pipe2(0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, 0x0) inotify_rm_watch(r0, r1) 02:24:35 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, &(0x7f0000000040), 0x0}, 0x18) 02:24:35 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) 02:24:35 executing program 3: socket(0x1e, 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) 02:24:35 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000060000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:35 executing program 3: socket(0x1e, 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) [ 502.465315] binder_alloc: 25619: binder_alloc_buf size 4893816 failed, no address space [ 502.483478] kernel msg: ebtables bug: please report to author: bad policy 02:24:35 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) 02:24:35 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 502.513600] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:35 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:24:35 executing program 3: socket(0x1e, 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) 02:24:35 executing program 5: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x33) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="1085cf5b786ccf0db13077eb0701ade1532ad0d3052fc73ca6940172418889202e111006ac349325ce5d22354c39c85cb0e4a56e9136a3d0ea"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 02:24:35 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) [ 502.612741] binder: 25619:25620 transaction failed 29201/-28, size 4893815-0 line 3035 [ 502.651344] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:24:35 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 502.672405] binder_alloc: binder_alloc_mmap_handler: 25619 20a00000-20e00000 already mapped failed -16 02:24:35 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) [ 502.718204] binder: BINDER_SET_CONTEXT_MGR already set 02:24:35 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, 0x0, 0x0) 02:24:35 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000001c0)) [ 502.741525] binder: 25619:25620 ioctl 40046207 0 returned -16 [ 502.815108] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 502.841429] binder_alloc: 25619: binder_alloc_buf, no vma 02:24:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000068000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:35 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:35 executing program 5: 02:24:35 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:24:35 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000001c0)) 02:24:35 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x18) [ 502.872327] binder: 25619:25670 transaction failed 29189/-3, size 4893815-0 line 3035 [ 502.886337] binder: undelivered TRANSACTION_ERROR: 29201 [ 502.909953] binder: undelivered TRANSACTION_ERROR: 29189 02:24:35 executing program 5: [ 502.949406] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:24:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:36 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x6) 02:24:36 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x18) 02:24:36 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000001c0)) 02:24:36 executing program 5: [ 503.040034] binder_alloc: 25687: binder_alloc_buf size 4893816 failed, no address space [ 503.056393] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 503.100214] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher [ 503.116830] binder: 25687:25689 transaction failed 29201/-28, size 4893815-0 line 3035 [ 503.147300] binder_alloc: binder_alloc_mmap_handler: 25687 20a00000-20e00000 already mapped failed -16 [ 503.201471] binder: BINDER_SET_CONTEXT_MGR already set [ 503.210059] binder: 25687:25689 ioctl 40046207 0 returned -16 [ 503.220538] binder_alloc: 25687: binder_alloc_buf, no vma [ 503.230663] binder: 25687:25707 transaction failed 29189/-3, size 4893815-0 line 3035 [ 503.242513] binder: undelivered TRANSACTION_ERROR: 29201 02:24:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000006c000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:36 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={0xffffffffffffffff, &(0x7f0000000040), 0x0}, 0x18) 02:24:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:36 executing program 5: 02:24:36 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)) 02:24:36 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x6) [ 503.256935] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.293038] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 02:24:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:36 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x6) 02:24:36 executing program 5: [ 503.339569] binder_alloc: 25720: binder_alloc_buf size 4893816 failed, no address space [ 503.352798] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 503.362554] binder: 25720:25721 transaction failed 29201/-28, size 4893815-0 line 3035 [ 503.373084] binder_alloc: binder_alloc_mmap_handler: 25720 20a00000-20e00000 already mapped failed -16 02:24:36 executing program 5: 02:24:36 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, 0x0, 0x0}, 0x18) 02:24:36 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)) [ 503.452198] binder: BINDER_SET_CONTEXT_MGR already set [ 503.471655] binder: 25720:25721 ioctl 40046207 0 returned -16 [ 503.477817] binder_alloc: 25720: binder_alloc_buf, no vma [ 503.528645] binder: undelivered TRANSACTION_ERROR: 29201 [ 503.535169] binder: 25720:25728 transaction failed 29189/-3, size 4893815-0 line 3035 [ 503.536273] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher [ 503.562214] binder: undelivered TRANSACTION_ERROR: 29189 02:24:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000074000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:36 executing program 5: pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0xe212, 0x0) 02:24:36 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:36 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, 0x0, 0x0}, 0x18) 02:24:36 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)) 02:24:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x170, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0x70, 0xa8, 0xe0}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x1e8) 02:24:36 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xa, 0x800, 0x3}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000001180)={r0, 0x0, 0x0}, 0x18) 02:24:36 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) 02:24:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x170, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0x70, 0xa8, 0xe0}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x1e8) 02:24:36 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 503.690503] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 503.717070] binder_alloc: 25755: binder_alloc_buf size 4893816 failed, no address space [ 503.763281] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:36 executing program 0: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000000200)='lo&\x00', 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4600f6ff000000000000000000030003"], 0x13) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 02:24:36 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) [ 503.827835] binder_alloc: binder_alloc_mmap_handler: 25755 20a00000-20e00000 already mapped failed -16 [ 503.839561] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 503.858805] binder: BINDER_SET_CONTEXT_MGR already set 02:24:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000007a000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 503.897823] binder: 25755:25756 ioctl 40046207 0 returned -16 [ 503.917912] binder_alloc: 25755: binder_alloc_buf, no vma [ 503.992315] binder_alloc: 25784: binder_alloc_buf size 4893816 failed, no address space [ 504.001189] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 504.012433] binder_alloc: binder_alloc_mmap_handler: 25784 20a00000-20e00000 already mapped failed -16 [ 504.022284] binder: BINDER_SET_CONTEXT_MGR already set [ 504.027717] binder: 25784:25785 ioctl 40046207 0 returned -16 [ 504.027929] binder_alloc: 25784: binder_alloc_buf, no vma 02:24:37 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:37 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:37 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x170, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0x70, 0xa8, 0xe0}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x1e8) 02:24:37 executing program 0: r0 = socket$inet(0x10, 0x0, 0x0) recvmsg(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)=""/246, 0xf6}], 0x1}, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f0000002680)=""/135, 0x65dd67bc8b9f0480) socket$inet_udplite(0x2, 0x2, 0x88) pread64(0xffffffffffffffff, &(0x7f00000005c0)=""/178, 0xb2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r1, 0x0) socket$packet(0x11, 0x0, 0x300) close(0xffffffffffffffff) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r1, 0x0) readv(r2, &(0x7f0000000180)=[{&(0x7f0000001200)=""/4096, 0xfffffe19}], 0x1) 02:24:37 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) 02:24:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000078ac4a0000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:37 executing program 3: r0 = socket(0x0, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 504.504090] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 504.505186] binder_alloc: 25797: binder_alloc_buf size 4893816 failed, no address space 02:24:37 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:37 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1a8, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0xe0, 0x118, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x220) [ 504.598527] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:37 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) clone(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x3, 0x0) 02:24:37 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:37 executing program 3: r0 = socket(0x0, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:37 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1a8, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0xe0, 0x118, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x220) [ 504.647815] binder_alloc: binder_alloc_mmap_handler: 25797 20a00000-20e00000 already mapped failed -16 [ 504.674734] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:24:37 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 504.723645] binder: BINDER_SET_CONTEXT_MGR already set [ 504.787234] binder: 25797:25801 ioctl 40046207 0 returned -16 [ 504.808760] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:24:37 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1a8, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0xe0, 0x118, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x220) 02:24:37 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 504.839347] binder_alloc: 25797: binder_alloc_buf, no vma 02:24:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000100000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:37 executing program 3: r0 = socket(0x0, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 504.948562] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 504.961457] binder_alloc: 25849: binder_alloc_buf size 4893816 failed, no address space 02:24:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 505.012682] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 505.104624] binder_alloc: binder_alloc_mmap_handler: 25849 20a00000-20e00000 already mapped failed -16 02:24:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000008) clone(0x0, &(0x7f0000000240), 0x0, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x3, 0x0) 02:24:38 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 3: r0 = socket(0x1e, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 505.150588] binder: BINDER_SET_CONTEXT_MGR already set [ 505.161109] binder: 25849:25850 ioctl 40046207 0 returned -16 [ 505.173903] binder_alloc: 25849: binder_alloc_buf, no vma 02:24:38 executing program 3: r0 = socket(0x1e, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000200000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:38 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 3: r0 = socket(0x1e, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 505.410530] binder_alloc: 25889: binder_alloc_buf size 4893816 failed, no address space 02:24:38 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 505.459533] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 505.539055] binder_alloc: binder_alloc_mmap_handler: 25889 20a00000-20e00000 already mapped failed -16 02:24:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 505.588135] binder: BINDER_SET_CONTEXT_MGR already set [ 505.607287] binder: 25889:25890 ioctl 40046207 0 returned -16 [ 505.620948] binder_alloc: 25889: binder_alloc_buf, no vma 02:24:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000300000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:38 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 505.789331] binder: BINDER_SET_CONTEXT_MGR already set [ 505.803631] binder: 25919:25923 ioctl 40046207 0 returned -16 02:24:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000400000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:38 executing program 0: perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x10001, 0x80000004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_gettime(0x0, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) open(0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = dup(r2) getsockopt$bt_hci(r3, 0x0, 0x1, &(0x7f0000000540)=""/235, &(0x7f0000000440)=0xeb) setsockopt$inet6_tcp_int(r3, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$int_in(r3, 0x5452, 0x0) ioctl$int_out(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) mkdirat(r0, 0x0, 0x10) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, 0x0, 0x284) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0xffffffffffffffff) setsockopt$inet6_MCAST_LEAVE_GROUP(r4, 0x29, 0x2d, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) ftruncate(r4, 0x7fff) sendfile(r3, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 02:24:38 executing program 1: mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:38 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:38 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 505.946375] binder: BINDER_SET_CONTEXT_MGR already set [ 506.009728] binder: 25938:25940 ioctl 40046207 0 returned -16 02:24:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000500000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:39 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:39 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 506.049640] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 02:24:39 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 506.195914] binder: BINDER_SET_CONTEXT_MGR already set 02:24:39 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:39 executing program 0: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) read(r0, &(0x7f0000000000)=""/250, 0x128b9372) fcntl$setstatus(r0, 0x4, 0x40400) [ 506.226645] binder: 25964:25966 ioctl 40046207 0 returned -16 02:24:39 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000600000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:39 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 506.372392] binder: BINDER_SET_CONTEXT_MGR already set 02:24:39 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:39 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 506.403456] binder: 25984:25986 ioctl 40046207 0 returned -16 02:24:39 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000700000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:39 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:39 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, 0x0, 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:39 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 506.654679] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 506.654689] binder_alloc: 26007: binder_alloc_buf size 4893816 failed, no address space [ 506.690600] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 506.690618] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 506.752464] binder_transaction: 18 callbacks suppressed [ 506.752481] binder: 26007:26011 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:39 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) write$cgroup_type(r1, &(0x7f00000000c0)='threaded\x00', 0xff4c) 02:24:39 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:39 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:39 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, 0x0, 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:39 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 506.816821] binder_alloc_mmap_handler: 4 callbacks suppressed [ 506.816838] binder_alloc: binder_alloc_mmap_handler: 26007 20a00000-20e00000 already mapped failed -16 [ 506.842535] binder: BINDER_SET_CONTEXT_MGR already set [ 506.849186] binder: 26007:26011 ioctl 40046207 0 returned -16 [ 506.855393] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 506.855401] binder_alloc: 26007: binder_alloc_buf, no vma 02:24:39 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, 0x0, 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:39 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 506.900474] binder: 26007:26020 transaction failed 29189/-3, size 4893815-0 line 3035 [ 506.903541] binder_release_work: 18 callbacks suppressed [ 506.903548] binder: undelivered TRANSACTION_ERROR: 29201 [ 506.920062] binder: undelivered TRANSACTION_ERROR: 29189 02:24:39 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000a00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:40 executing program 3: socket(0x1e, 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) [ 507.070387] binder_alloc: 26045: binder_alloc_buf size 4893816 failed, no address space [ 507.081637] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 507.091521] binder: 26045:26046 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 507.132584] binder_alloc: binder_alloc_mmap_handler: 26045 20a00000-20e00000 already mapped failed -16 02:24:40 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 507.177716] binder: BINDER_SET_CONTEXT_MGR already set 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 507.208385] binder: 26045:26046 ioctl 40046207 0 returned -16 02:24:40 executing program 3: socket(0x1e, 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) 02:24:40 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 507.260471] binder_alloc: 26045: binder_alloc_buf, no vma [ 507.303542] binder: 26045:26061 transaction failed 29189/-3, size 4893815-0 line 3035 [ 507.338150] binder: undelivered TRANSACTION_ERROR: 29201 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 507.354118] binder: undelivered TRANSACTION_ERROR: 29189 02:24:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000001200000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:40 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 3: socket(0x1e, 0x1, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)) 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(0x0, 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:40 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 507.509757] binder_alloc: 26081: binder_alloc_buf size 4893816 failed, no address space 02:24:40 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(0x0, 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 507.580684] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:40 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) [ 507.647058] binder: 26081:26086 transaction failed 29201/-28, size 4893815-0 line 3035 [ 507.686448] binder_alloc: binder_alloc_mmap_handler: 26081 20a00000-20e00000 already mapped failed -16 [ 507.747864] binder: BINDER_SET_CONTEXT_MGR already set [ 507.796366] binder: 26081:26086 ioctl 40046207 0 returned -16 [ 507.820865] binder_alloc: 26081: binder_alloc_buf, no vma 02:24:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000002000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(0x0, 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:40 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f00000001c0)) 02:24:40 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 507.841128] binder: 26081:26116 transaction failed 29189/-3, size 4893815-0 line 3035 [ 507.850172] binder: undelivered TRANSACTION_ERROR: 29201 [ 507.860399] binder: undelivered TRANSACTION_ERROR: 29189 02:24:40 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:40 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:40 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000001c0)) 02:24:40 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 507.955304] binder_alloc: 26127: binder_alloc_buf size 4893816 failed, no address space [ 508.017981] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 508.050563] binder: 26127:26130 transaction failed 29201/-28, size 4893815-0 line 3035 [ 508.064428] binder_alloc: binder_alloc_mmap_handler: 26127 20a00000-20e00000 already mapped failed -16 [ 508.089205] binder: BINDER_SET_CONTEXT_MGR already set [ 508.097164] binder: 26127:26130 ioctl 40046207 0 returned -16 [ 508.108286] binder_alloc: 26127: binder_alloc_buf, no vma 02:24:41 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000001c0)) [ 508.116118] binder: 26127:26135 transaction failed 29189/-3, size 4893815-0 line 3035 [ 508.129454] binder: undelivered TRANSACTION_ERROR: 29201 [ 508.139579] binder: undelivered TRANSACTION_ERROR: 29189 02:24:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000003f00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:41 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 508.310229] binder_alloc: 26158: binder_alloc_buf size 4893816 failed, no address space [ 508.322896] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 508.342135] binder: 26158:26162 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r1, &(0x7f00000001c0)) 02:24:41 executing program 0: socket$inet(0x2, 0x200000002, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 508.353061] binder_alloc: binder_alloc_mmap_handler: 26158 20a00000-20e00000 already mapped failed -16 [ 508.370319] binder: BINDER_SET_CONTEXT_MGR already set [ 508.380161] binder: 26158:26162 ioctl 40046207 0 returned -16 02:24:41 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, 0x0, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000004800000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 508.472826] binder: undelivered TRANSACTION_ERROR: 29201 02:24:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 3: r0 = socket(0x1e, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)) 02:24:41 executing program 0: socket$inet(0x2, 0x200000002, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 508.582145] binder_alloc: 26184: binder_alloc_buf size 4893816 failed, no address space 02:24:41 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, 0x0, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 508.640174] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 0: socket$inet(0x2, 0x200000002, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:41 executing program 3: r0 = socket(0x1e, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)) [ 508.715886] binder: 26184:26185 transaction failed 29201/-28, size 4893815-0 line 3035 [ 508.742318] binder_alloc: binder_alloc_mmap_handler: 26184 20a00000-20e00000 already mapped failed -16 02:24:41 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, 0x0, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 508.794736] binder: BINDER_SET_CONTEXT_MGR already set [ 508.800989] binder: 26184:26185 ioctl 40046207 0 returned -16 02:24:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 508.856578] binder_alloc: 26184: binder_alloc_buf, no vma [ 508.862864] binder: undelivered TRANSACTION_ERROR: 29189 02:24:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000004c00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:41 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:41 executing program 3: r0 = socket(0x1e, 0x1, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f00000001c0)) 02:24:41 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180), 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:41 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180), 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:42 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, 0x0) 02:24:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 509.042421] binder_alloc: 26231: binder_alloc_buf size 4893816 failed, no address space [ 509.079656] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 509.167587] binder_alloc: binder_alloc_mmap_handler: 26231 20a00000-20e00000 already mapped failed -16 [ 509.227955] binder_alloc: 26231: binder_alloc_buf, no vma [ 509.239586] binder: BINDER_SET_CONTEXT_MGR already set 02:24:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000006000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:42 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180), 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, 0x0) 02:24:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, 0xffffffffffffffff, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 509.293466] binder: 26231:26232 ioctl 40046207 0 returned -16 02:24:42 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, 0xffffffffffffffff, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:42 executing program 3: r0 = socket(0x1e, 0x1, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, 0x0) [ 509.393388] binder_alloc: 26266: binder_alloc_buf size 4893816 failed, no address space [ 509.401775] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, 0xffffffffffffffff, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 509.502180] binder_alloc: binder_alloc_mmap_handler: 26266 20a00000-20e00000 already mapped failed -16 [ 509.557465] binder_alloc: 26266: binder_alloc_buf, no vma [ 509.557536] binder: BINDER_SET_CONTEXT_MGR already set 02:24:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000006800000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000440)={0x2000000007b, 0x0, [0x4b564d02, 0x1000000000000a67]}) 02:24:42 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 509.639673] binder: 26266:26267 ioctl 40046207 0 returned -16 02:24:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 509.737565] binder_alloc: 26300: binder_alloc_buf size 4893816 failed, no address space 02:24:42 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:42 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 509.807357] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:42 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x0, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:42 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x13, 0x3, &(0x7f0000000040)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f00000003c0)='sy\xb0\x15\xe6JXd\x17\xdc\xbf', 0x7fff, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e460cdfba83c7074230707004305", 0x0}, 0x28) [ 509.893363] binder_alloc: binder_alloc_mmap_handler: 26300 20a00000-20e00000 already mapped failed -16 [ 509.936814] binder: BINDER_SET_CONTEXT_MGR already set [ 509.961867] binder: 26300:26301 ioctl 40046207 0 returned -16 [ 509.968178] binder_alloc: 26300: binder_alloc_buf, no vma 02:24:43 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:43 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x6) 02:24:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000006c00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x0, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 3: 02:24:43 executing program 3: 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x0, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(0xffffffffffffffff, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 510.160228] binder_alloc: 26332: binder_alloc_buf size 4893816 failed, no address space 02:24:43 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x6) [ 510.223329] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 3: 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 510.297533] binder_alloc: binder_alloc_mmap_handler: 26332 20a00000-20e00000 already mapped failed -16 [ 510.316881] binder: BINDER_SET_CONTEXT_MGR already set [ 510.322312] binder: 26332:26334 ioctl 40046207 0 returned -16 [ 510.328865] binder_alloc: 26332: binder_alloc_buf, no vma 02:24:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000007400000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(0xffffffffffffffff, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:43 executing program 3: 02:24:43 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000240), 0x6) 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) [ 510.550399] binder: BINDER_SET_CONTEXT_MGR already set 02:24:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(0xffffffffffffffff, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:43 executing program 3: 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 3: [ 510.614679] binder: 26370:26371 ioctl 40046207 0 returned -16 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000004aac7800000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:43 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:43 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:43 executing program 3: [ 510.809679] binder: BINDER_SET_CONTEXT_MGR already set 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:43 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000240), 0x6) 02:24:43 executing program 3: [ 510.841599] binder_alloc: 26392: binder_alloc_buf, no vma [ 510.876418] binder: 26392:26394 ioctl 40046207 0 returned -16 02:24:43 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000007a00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:44 executing program 3: [ 511.087060] binder: BINDER_SET_CONTEXT_MGR already set 02:24:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) [ 511.121943] binder: 26422:26423 ioctl 40046207 0 returned -16 02:24:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:44 executing program 3: 02:24:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000fffffdfd00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) 02:24:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 3: [ 511.393815] binder: BINDER_SET_CONTEXT_MGR already set 02:24:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) [ 511.454864] binder: 26450:26454 ioctl 40046207 0 returned -16 02:24:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 3: 02:24:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x0, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 02:24:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000fdfdffff00000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) [ 511.702066] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 511.702077] binder_alloc: 26483: binder_alloc_buf size 4893816 failed, no address space 02:24:44 executing program 3: 02:24:44 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x0, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 511.799962] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 511.800006] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:44 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) [ 511.842850] binder_transaction: 16 callbacks suppressed [ 511.842869] binder: 26483:26484 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:44 executing program 3: 02:24:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x0, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:44 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:44 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 511.953136] binder_alloc_mmap_handler: 4 callbacks suppressed [ 511.953159] binder_alloc: binder_alloc_mmap_handler: 26483 20a00000-20e00000 already mapped failed -16 [ 512.003295] binder: BINDER_SET_CONTEXT_MGR already set [ 512.008609] binder: 26483:26484 ioctl 40046207 0 returned -16 [ 512.088237] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 512.088255] binder_alloc: 26483: binder_alloc_buf, no vma [ 512.130333] binder: 26483:26515 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000001000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:45 executing program 1: 02:24:45 executing program 3: 02:24:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 512.202688] binder_release_work: 16 callbacks suppressed [ 512.202695] binder: undelivered TRANSACTION_ERROR: 29201 [ 512.234134] binder: undelivered TRANSACTION_ERROR: 29189 02:24:45 executing program 3: 02:24:45 executing program 1: 02:24:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, 0x0, 0x0) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 512.372904] binder_alloc: 26529: binder_alloc_buf size 4893816 failed, no address space 02:24:45 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001a00)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) close(r2) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000b04000)={0x0, 0x0, 0x0, &(0x7f0000000000)=""/95, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001400)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000d7c000)={0x0, r2}) [ 512.463405] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 512.489528] binder: 26529:26531 transaction failed 29201/-28, size 4893815-0 line 3035 [ 512.553566] binder_alloc: binder_alloc_mmap_handler: 26529 20a00000-20e00000 already mapped failed -16 [ 512.598541] binder: BINDER_SET_CONTEXT_MGR already set [ 512.611913] binder: 26529:26531 ioctl 40046207 0 returned -16 [ 512.619824] binder_alloc: 26529: binder_alloc_buf, no vma [ 512.625731] binder: 26529:26552 transaction failed 29189/-3, size 4893815-0 line 3035 [ 512.635411] binder: undelivered TRANSACTION_ERROR: 29201 [ 512.643482] binder: undelivered TRANSACTION_ERROR: 29189 02:24:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000002000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:45 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000180)=0x10000000000006) r1 = syz_open_pts(r0, 0x0) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x1ff) ioctl$TCFLSH(r1, 0x540b, 0x2) 02:24:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:45 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) [ 512.709528] binder_alloc: 26555: binder_alloc_buf size 4893816 failed, no address space [ 512.737687] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 512.772951] binder: 26555:26563 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) [ 512.818142] binder_alloc: binder_alloc_mmap_handler: 26555 20a00000-20e00000 already mapped failed -16 02:24:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 512.866335] binder: BINDER_SET_CONTEXT_MGR already set 02:24:45 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 512.894794] binder: 26555:26563 ioctl 40046207 0 returned -16 [ 512.928153] binder_alloc: 26555: binder_alloc_buf, no vma [ 512.972243] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.064187] binder: 26555:26578 transaction failed 29189/-3, size 4893815-0 line 3035 [ 513.086347] binder: undelivered TRANSACTION_ERROR: 29189 02:24:46 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x40) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) pipe(0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) syz_open_dev$sndseq(0x0, 0x0, 0x8000800000007f) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, 0x0) geteuid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) ftruncate(r2, 0x208200) r3 = open(&(0x7f0000000780)='./bus\x00', 0x14102e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r3, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, 0x0) tkill(0x0, 0xf) pread64(r1, 0x0, 0xffffffffffffffa0, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x100000000}) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) 02:24:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:46 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) getgid() add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e5", 0x27, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r3 = request_key(&(0x7f0000000300)='encrypted\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r3, 0x0, &(0x7f00000004c0)='TRUE') stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f00000001c0)={0x0, 0x1000}) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x1400) fstat(r2, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in6=@loopback, 0x4e23, 0x1, 0x4e24, 0x1000, 0xa, 0x80, 0xa0, 0x67, 0x0, r4}, {0x20, 0x8001, 0x3f, 0x7fff, 0x4, 0x2, 0x4, 0x61}, {0xbf73, 0x6, 0x401, 0x4}, 0x3, 0x6e6bb3, 0x3, 0x0, 0x3, 0x2}, {{@in6=@empty, 0x4d5, 0x6c}, 0x2, @in6=@mcast1, 0x3503, 0x2, 0x3, 0x2, 0x101, 0x78b2800000000, 0x40}}, 0xe8) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) setpgid(r0, r0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0xbd49, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, r0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') setxattr$trusted_overlay_upper(&(0x7f0000000400)='./file0\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', &(0x7f0000000500)={0x0, 0xfb, 0x4f, 0x6, 0x5, "fae6bc8cf1a5ca4bd5bbd3cdfa564485", "b5484f407fbc4e33194c715a92a38be87b7ef8659097a96061a752d6f651980e043b0c925bd4beb6ad57328dd4eec9ee787631db6244c9b70270"}, 0x4f, 0x2) listen(r2, 0xd4) mkdir(&(0x7f0000000040)='./file0\x00', 0x40) dup2(0xffffffffffffffff, 0xffffffffffffffff) 02:24:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:46 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000003000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 513.308537] binder_alloc: 26598: binder_alloc_buf size 4893816 failed, no address space [ 513.343311] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:46 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 513.370624] binder: 26598:26599 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 513.423466] binder_alloc: binder_alloc_mmap_handler: 26598 20a00000-20e00000 already mapped failed -16 [ 513.455648] binder: BINDER_SET_CONTEXT_MGR already set 02:24:46 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:46 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 513.510443] binder: 26598:26599 ioctl 40046207 0 returned -16 [ 513.539571] binder_alloc: 26598: binder_alloc_buf, no vma [ 513.596230] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.602658] binder: 26598:26619 transaction failed 29189/-3, size 4893815-0 line 3035 [ 513.678409] binder: undelivered TRANSACTION_ERROR: 29189 02:24:47 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x40) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, 0x0) geteuid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) ftruncate(r2, 0x208200) r3 = open(&(0x7f0000000780)='./bus\x00', 0x14102e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r3, 0x0) add_key(0x0, 0x0, &(0x7f0000000180), 0x0, 0xfffffffffffffffb) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) pread64(r1, 0x0, 0xffffffffffffffa0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x100000000}) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) 02:24:47 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) getgid() add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e5", 0x27, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r3 = request_key(&(0x7f0000000300)='encrypted\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r3, 0x0, &(0x7f00000004c0)='TRUE') stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f00000001c0)={0x0, 0x1000}) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x1400) fstat(r2, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in6=@loopback, 0x4e23, 0x1, 0x4e24, 0x1000, 0xa, 0x80, 0xa0, 0x67, 0x0, r4}, {0x20, 0x8001, 0x3f, 0x7fff, 0x4, 0x2, 0x4, 0x61}, {0xbf73, 0x6, 0x401, 0x4}, 0x3, 0x6e6bb3, 0x3, 0x0, 0x3, 0x2}, {{@in6=@empty, 0x4d5, 0x6c}, 0x2, @in6=@mcast1, 0x3503, 0x2, 0x3, 0x2, 0x101, 0x78b2800000000, 0x40}}, 0xe8) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) setpgid(r0, r0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0xbd49, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, r0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') setxattr$trusted_overlay_upper(&(0x7f0000000400)='./file0\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', &(0x7f0000000500)={0x0, 0xfb, 0x4f, 0x6, 0x5, "fae6bc8cf1a5ca4bd5bbd3cdfa564485", "b5484f407fbc4e33194c715a92a38be87b7ef8659097a96061a752d6f651980e043b0c925bd4beb6ad57328dd4eec9ee787631db6244c9b70270"}, 0x4f, 0x2) listen(r2, 0xd4) mkdir(&(0x7f0000000040)='./file0\x00', 0x40) dup2(0xffffffffffffffff, 0xffffffffffffffff) 02:24:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:47 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000004000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:47 executing program 0: socket$inet(0x2, 0x200000002, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(0xffffffffffffffff, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 514.125931] binder_alloc: 26642: binder_alloc_buf size 4893816 failed, no address space 02:24:47 executing program 0: socket$inet(0x2, 0x200000002, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(0xffffffffffffffff, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 514.169858] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:47 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 514.210921] binder: 26642:26643 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:47 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) getgid() add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e5", 0x27, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r3 = request_key(&(0x7f0000000300)='encrypted\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r3, 0x0, &(0x7f00000004c0)='TRUE') stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x1400) fstat(r2, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in6=@loopback, 0x4e23, 0x1, 0x4e24, 0x1000, 0xa, 0x80, 0xa0, 0x67, 0x0, r4}, {0x20, 0x8001, 0x3f, 0x7fff, 0x4, 0x2, 0x4, 0x61}, {0xbf73, 0x6, 0x401, 0x4}, 0x3, 0x6e6bb3, 0x3, 0x0, 0x3, 0x2}, {{@in6=@empty, 0x4d5, 0x6c}, 0x2, @in6=@mcast1, 0x3503, 0x2, 0x3, 0x2, 0x101, 0x78b2800000000, 0x40}}, 0xe8) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) setpgid(r0, r0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0xbd49, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, r0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') setxattr$trusted_overlay_upper(&(0x7f0000000400)='./file0\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', &(0x7f0000000500)={0x0, 0xfb, 0x4f, 0x6, 0x5, "fae6bc8cf1a5ca4bd5bbd3cdfa564485", "b5484f407fbc4e33194c715a92a38be87b7ef8659097a96061a752d6f651980e043b0c925bd4beb6ad57328dd4eec9ee787631db6244c9b70270"}, 0x4f, 0x2) listen(r2, 0xd4) mkdir(&(0x7f0000000040)='./file0\x00', 0x40) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 514.254664] binder_alloc: binder_alloc_mmap_handler: 26642 20a00000-20e00000 already mapped failed -16 [ 514.312111] binder: BINDER_SET_CONTEXT_MGR already set 02:24:47 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='cpuset.cpu_exclusive\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f00000000c0)=0xca9, 0x12) 02:24:47 executing program 0: socket$inet(0x2, 0x200000002, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(0xffffffffffffffff, r1, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) [ 514.335731] binder: 26642:26643 ioctl 40046207 0 returned -16 [ 514.360194] binder_alloc: 26642: binder_alloc_buf, no vma [ 514.398441] binder: 26642:26659 transaction failed 29189/-3, size 4893815-0 line 3035 [ 514.433885] binder: undelivered TRANSACTION_ERROR: 29201 [ 514.440735] binder: undelivered TRANSACTION_ERROR: 29189 02:24:48 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000005000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:48 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, 0xffffffffffffffff, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:48 executing program 3: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x1, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) getgid() add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000640)={'syz', 0x3}, &(0x7f00000007c0)="dca3c74b87c88ccd47653a443b23f60d3dca0fbfc05354f40c0b13017f5ae5c1f35a7a01e1e9e5", 0x27, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) r3 = request_key(&(0x7f0000000300)='encrypted\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000440)=':\x00', 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r3, 0x0, &(0x7f00000004c0)='TRUE') stat(&(0x7f0000000a40)='./file0/../file0\x00', 0x0) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000140)='logon\x00', &(0x7f00000008c0)={'syz', 0x0}, 0x0, 0xfffffffffffffff8) linkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x1400) fstat(r2, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in6=@loopback, 0x4e23, 0x1, 0x4e24, 0x1000, 0xa, 0x80, 0xa0, 0x67, 0x0, r4}, {0x20, 0x8001, 0x3f, 0x7fff, 0x4, 0x2, 0x4, 0x61}, {0xbf73, 0x6, 0x401, 0x4}, 0x3, 0x6e6bb3, 0x3, 0x0, 0x3, 0x2}, {{@in6=@empty, 0x4d5, 0x6c}, 0x2, @in6=@mcast1, 0x3503, 0x2, 0x3, 0x2, 0x101, 0x78b2800000000, 0x40}}, 0xe8) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000b80)={0x0, &(0x7f0000000b00)=""/119}) setpgid(r0, r0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0xbd49, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, r0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') setxattr$trusted_overlay_upper(&(0x7f0000000400)='./file0\x00', &(0x7f0000000480)='trusted.overlay.upper\x00', &(0x7f0000000500)={0x0, 0xfb, 0x4f, 0x6, 0x5, "fae6bc8cf1a5ca4bd5bbd3cdfa564485", "b5484f407fbc4e33194c715a92a38be87b7ef8659097a96061a752d6f651980e043b0c925bd4beb6ad57328dd4eec9ee787631db6244c9b70270"}, 0x4f, 0x2) listen(r2, 0xd4) mkdir(&(0x7f0000000040)='./file0\x00', 0x40) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 515.140907] binder_alloc: 26677: binder_alloc_buf size 4893816 failed, no address space 02:24:48 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, 0xffffffffffffffff, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:48 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:48 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 515.203688] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:48 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x67}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 515.279153] binder_alloc: binder_alloc_mmap_handler: 26677 20a00000-20e00000 already mapped failed -16 [ 515.327357] binder: BINDER_SET_CONTEXT_MGR already set 02:24:48 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x1a, 0xffffff84}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 515.378262] binder: 26677:26678 ioctl 40046207 0 returned -16 [ 515.416033] binder_alloc: 26677: binder_alloc_buf, no vma 02:24:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000006000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:48 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, 0xffffffffffffffff, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:48 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 3: 02:24:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 515.626994] binder_alloc: 26720: binder_alloc_buf size 4893816 failed, no address space 02:24:48 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:48 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:48 executing program 3: [ 515.713347] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 515.747459] binder_alloc: binder_alloc_mmap_handler: 26720 20a00000-20e00000 already mapped failed -16 02:24:48 executing program 1: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 515.805842] binder: BINDER_SET_CONTEXT_MGR already set [ 515.823707] binder: 26720:26722 ioctl 40046207 0 returned -16 [ 515.866648] binder_alloc: 26720: binder_alloc_buf, no vma 02:24:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000007000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:48 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:48 executing program 3: 02:24:48 executing program 5: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:48 executing program 1: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:49 executing program 3: 02:24:49 executing program 1: bpf$PROG_LOAD(0x5, 0x0, 0x0) [ 516.052986] binder_alloc: 26755: binder_alloc_buf size 4893816 failed, no address space 02:24:49 executing program 5: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:49 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) 02:24:49 executing program 3: [ 516.155558] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 516.243543] binder_alloc: binder_alloc_mmap_handler: 26755 20a00000-20e00000 already mapped failed -16 02:24:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000a000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:49 executing program 5: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:49 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:49 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, 0x0, 0x0) 02:24:49 executing program 3: 02:24:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 516.336858] binder_alloc: 26755: binder_alloc_buf, no vma 02:24:49 executing program 3: [ 516.403793] device bridge_slave_1 left promiscuous mode [ 516.409473] bridge0: port 2(bridge_slave_1) entered disabled state 02:24:49 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:49 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:49 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, 0x0, 0x0) [ 516.461910] binder_alloc: 26793: binder_alloc_buf size 4893816 failed, no address space [ 516.477219] device bridge_slave_0 left promiscuous mode [ 516.482754] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.500349] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:49 executing program 3: [ 516.592215] binder_alloc: binder_alloc_mmap_handler: 26793 20a00000-20e00000 already mapped failed -16 [ 516.642304] binder: BINDER_SET_CONTEXT_MGR already set [ 516.675937] binder: 26793:26794 ioctl 40046207 0 returned -16 [ 516.693925] binder_alloc: 26793: binder_alloc_buf, no vma 02:24:49 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:49 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:49 executing program 3: 02:24:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000012000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:49 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, 0x0, 0x0) 02:24:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:49 executing program 3: 02:24:49 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 516.832316] binder_alloc: 26822: binder_alloc_buf size 4893816 failed, no address space 02:24:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:49 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 516.884779] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:49 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x2e) 02:24:49 executing program 3: [ 516.935340] binder_transaction: 8 callbacks suppressed [ 516.935360] binder: 26822:26827 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 517.061116] binder_alloc: binder_alloc_mmap_handler: 26822 20a00000-20e00000 already mapped failed -16 [ 517.131327] binder: BINDER_SET_CONTEXT_MGR already set [ 517.154049] binder: 26822:26827 ioctl 40046207 0 returned -16 [ 517.180826] binder_alloc: 26822: binder_alloc_buf, no vma [ 517.190758] binder: 26822:26853 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000020000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:50 executing program 2: 02:24:50 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x2e) 02:24:50 executing program 3: 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 517.253462] binder_release_work: 8 callbacks suppressed [ 517.253470] binder: undelivered TRANSACTION_ERROR: 29189 [ 517.265970] binder: undelivered TRANSACTION_ERROR: 29201 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 2: [ 517.332356] binder_alloc: 26860: binder_alloc_buf size 4893816 failed, no address space 02:24:50 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) dup3(r0, r2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x2e) 02:24:50 executing program 3: [ 517.397666] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 517.462043] binder: 26860:26864 transaction failed 29201/-28, size 4893815-0 line 3035 [ 517.526054] binder_alloc: binder_alloc_mmap_handler: 26860 20a00000-20e00000 already mapped failed -16 [ 517.570683] binder: BINDER_SET_CONTEXT_MGR already set [ 517.619267] binder: 26860:26864 ioctl 40046207 0 returned -16 [ 517.635550] binder_alloc: 26860: binder_alloc_buf, no vma [ 517.641814] binder: 26860:26885 transaction failed 29189/-3, size 4893815-0 line 3035 [ 517.650583] binder: undelivered TRANSACTION_ERROR: 29201 [ 517.660188] binder: undelivered TRANSACTION_ERROR: 29189 02:24:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000003f000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:50 executing program 2: 02:24:50 executing program 3: 02:24:50 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 0: 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) 02:24:50 executing program 0: 02:24:50 executing program 3: [ 517.772949] binder_alloc: 26895: binder_alloc_buf size 4893816 failed, no address space 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:50 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 517.823006] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 517.888361] binder: 26895:26897 transaction failed 29201/-28, size 4893815-0 line 3035 02:24:50 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, 0x0, 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 517.932305] binder_alloc: binder_alloc_mmap_handler: 26895 20a00000-20e00000 already mapped failed -16 [ 517.983490] binder: BINDER_SET_CONTEXT_MGR already set [ 517.997001] binder_alloc: 26895: binder_alloc_buf, no vma 02:24:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000048000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:51 executing program 0: 02:24:51 executing program 3: 02:24:51 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, 0x0, 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:24:51 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, 0x0, 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 518.028851] binder: 26895:26897 ioctl 40046207 0 returned -16 [ 518.029801] binder: undelivered TRANSACTION_ERROR: 29201 [ 518.042064] binder: 26895:26910 transaction failed 29189/-3, size 4893815-0 line 3035 [ 518.057888] binder: undelivered TRANSACTION_ERROR: 29189 02:24:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, 0xffffffffffffffff, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 518.155944] binder_alloc: 26924: binder_alloc_buf size 4893816 failed, no address space [ 518.173405] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 518.225022] binder: 26924:26925 transaction failed 29201/-28, size 4893815-0 line 3035 [ 518.270063] binder_alloc: binder_alloc_mmap_handler: 26924 20a00000-20e00000 already mapped failed -16 [ 518.281818] binder: BINDER_SET_CONTEXT_MGR already set [ 518.290356] binder: 26924:26925 ioctl 40046207 0 returned -16 [ 518.290384] binder_alloc: 26924: binder_alloc_buf, no vma [ 518.302694] binder: 26924:26931 transaction failed 29189/-3, size 4893815-0 line 3035 [ 518.311160] binder: undelivered TRANSACTION_ERROR: 29201 [ 518.318152] binder: undelivered TRANSACTION_ERROR: 29189 [ 521.347837] device hsr_slave_1 left promiscuous mode [ 521.396313] device hsr_slave_0 left promiscuous mode [ 521.428340] team0 (unregistering): Port device team_slave_1 removed [ 521.439744] team0 (unregistering): Port device team_slave_0 removed [ 521.451871] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 521.490382] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 521.580772] bond0 (unregistering): Released all slaves 02:24:54 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, 0x0, 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:24:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:54 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, 0x0, 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:24:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x0, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000004c000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:54 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:54 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, 0x0, 0x1, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 521.744425] binder_alloc: 26939: binder_alloc_buf size 4893816 failed, no address space [ 521.777300] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 521.823368] binder: 26939:26940 transaction failed 29201/-28, size 4893815-0 line 3035 [ 521.857663] binder_alloc: binder_alloc_mmap_handler: 26939 20a00000-20e00000 already mapped failed -16 02:24:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 521.914234] binder: BINDER_SET_CONTEXT_MGR already set 02:24:54 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:54 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 521.937374] binder: 26939:26940 ioctl 40046207 0 returned -16 [ 521.972835] binder_alloc: 26939: binder_alloc_buf, no vma [ 521.993314] binder: 26939:26962 transaction failed 29189/-3, size 4893815-0 line 3035 [ 522.001732] binder: undelivered TRANSACTION_ERROR: 29201 [ 522.010036] binder: undelivered TRANSACTION_ERROR: 29189 02:24:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0x0, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000060000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:55 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x0, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x0, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 522.222602] binder_alloc: 26983: binder_alloc_buf size 4893816 failed, no address space 02:24:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:55 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1}, 0x48) 02:24:55 executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) mbind(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000180)=0xfffffffffffff801, 0x8001, 0x0) openat$cgroup_procs(r0, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x6) 02:24:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1}, 0x48) [ 522.330972] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, 0x0, 0x0) 02:24:55 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1}, 0x48) 02:24:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 522.467563] binder: 26983:26985 transaction failed 29201/-28, size 4893815-0 line 3035 [ 522.554419] binder_alloc: binder_alloc_mmap_handler: 26983 20a00000-20e00000 already mapped failed -16 [ 522.573414] binder: BINDER_SET_CONTEXT_MGR already set 02:24:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000068000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1}, 0x48) 02:24:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:55 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffad}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1}, 0x48) 02:24:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) 02:24:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7, 0x1, 0x3}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r0, 0x0, [0x305f, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c) [ 522.616124] binder: 26983:26985 ioctl 40046207 0 returned -16 [ 522.622425] binder_alloc: 26983: binder_alloc_buf, no vma [ 522.631767] binder: 26983:27019 transaction failed 29189/-3, size 4893815-0 line 3035 [ 522.642786] binder: undelivered TRANSACTION_ERROR: 29201 [ 522.649384] binder: undelivered TRANSACTION_ERROR: 29189 02:24:55 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffff84, 0xa}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1}, 0x48) [ 522.764796] binder_alloc: 27032: binder_alloc_buf size 4893816 failed, no address space [ 522.772991] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:55 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:55 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) 02:24:55 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 522.856193] kernel msg: ebtables bug: please report to author: Wrong len argument 02:24:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:55 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) [ 522.916648] binder: 27032:27033 transaction failed 29201/-28, size 4893815-0 line 3035 [ 522.946787] kernel msg: ebtables bug: please report to author: bad policy [ 522.954941] kernel msg: ebtables bug: please report to author: target size too small [ 522.963097] binder_alloc: binder_alloc_mmap_handler: 27032 20a00000-20e00000 already mapped failed -16 [ 522.973482] kernel msg: ebtables bug: please report to author: target size too small [ 523.008652] binder: BINDER_SET_CONTEXT_MGR already set [ 523.017046] kernel msg: ebtables bug: please report to author: Wrong len argument [ 523.033687] binder: 27032:27033 ioctl 40046207 0 returned -16 02:24:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000006c000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:56 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) [ 523.070256] binder_alloc: 27032: binder_alloc_buf, no vma [ 523.096985] binder: 27032:27059 transaction failed 29189/-3, size 4893815-0 line 3035 [ 523.105550] binder: undelivered TRANSACTION_ERROR: 29201 [ 523.113694] binder: undelivered TRANSACTION_ERROR: 29189 02:24:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 523.170481] kernel msg: ebtables bug: please report to author: target size too small [ 523.185092] kernel msg: ebtables bug: please report to author: Wrong len argument [ 523.192043] kernel msg: ebtables bug: please report to author: bad policy 02:24:56 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 523.229095] binder_alloc: 27068: binder_alloc_buf size 4893816 failed, no address space [ 523.282634] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 523.312848] kernel msg: ebtables bug: please report to author: target size too small 02:24:56 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf", 0xc) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)=""/101, 0x26b}], 0x1}}], 0x1, 0x0, 0x0) [ 523.329444] kernel msg: ebtables bug: please report to author: target size too small 02:24:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 523.364988] kernel msg: ebtables bug: please report to author: bad policy [ 523.367508] binder: 27068:27076 transaction failed 29201/-28, size 4893815-0 line 3035 [ 523.454412] binder_alloc: binder_alloc_mmap_handler: 27068 20a00000-20e00000 already mapped failed -16 [ 523.496442] binder_alloc: 27068: binder_alloc_buf, no vma [ 523.510971] binder: BINDER_SET_CONTEXT_MGR already set [ 523.516867] binder: 27068:27100 transaction failed 29189/-3, size 4893815-0 line 3035 [ 523.531388] binder: 27068:27101 ioctl 40046207 0 returned -16 [ 523.537849] binder: undelivered TRANSACTION_ERROR: 29201 02:24:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000074000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 0: socket$kcm(0x2, 0x200000000000001, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000346fc8)=@framed, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f00000002c0)=""/251}, 0x48) r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, 0x0) 02:24:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 523.551862] binder: undelivered TRANSACTION_ERROR: 29189 02:24:56 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:56 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 523.692620] binder_alloc: 27119: binder_alloc_buf size 4893816 failed, no address space 02:24:56 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 523.759523] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000010000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 523.839522] binder: 27119:27120 transaction failed 29201/-28, size 4893815-0 line 3035 [ 523.917576] binder: BINDER_SET_CONTEXT_MGR already set [ 523.926211] binder_alloc: binder_alloc_mmap_handler: 27119 20a00000-20e00000 already mapped failed -16 [ 523.971597] binder: 27141:27143 ioctl 40046207 0 returned -16 [ 523.971612] binder_alloc: 27119: binder_alloc_buf, no vma [ 523.977619] binder: BINDER_SET_CONTEXT_MGR already set [ 523.990857] binder: 27119:27120 ioctl 40046207 0 returned -16 [ 523.995736] binder: 27119:27144 transaction failed 29189/-3, size 4893815-0 line 3035 [ 523.997529] binder_alloc: 27119: binder_alloc_buf, no vma [ 524.011146] binder: 27141:27146 transaction failed 29189/-3, size 4893815-0 line 3035 02:24:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000004aac78000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:57 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 524.028102] binder: undelivered TRANSACTION_ERROR: 29201 [ 524.034069] binder: undelivered TRANSACTION_ERROR: 29189 [ 524.049973] binder: undelivered TRANSACTION_ERROR: 29189 [ 524.118662] kernel msg: ebtables bug: please report to author: bad policy 02:24:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 524.162929] binder_alloc: 27160: binder_alloc_buf size 4893816 failed, no address space 02:24:57 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 524.218357] kernel msg: ebtables bug: please report to author: target size too small [ 524.236562] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:57 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) [ 524.278231] binder_alloc: binder_alloc_mmap_handler: 27160 20a00000-20e00000 already mapped failed -16 [ 524.289713] kernel msg: ebtables bug: please report to author: target size too small [ 524.310324] kernel msg: ebtables bug: please report to author: bad policy [ 524.346047] binder: BINDER_SET_CONTEXT_MGR already set [ 524.380969] binder: 27160:27161 ioctl 40046207 0 returned -16 [ 524.403759] binder_alloc: 27160: binder_alloc_buf, no vma [ 524.433456] binder: undelivered TRANSACTION_ERROR: 29201 02:24:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007a000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:57 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) [ 524.492357] kernel msg: ebtables bug: please report to author: bad policy [ 524.513544] kernel msg: ebtables bug: please report to author: target size too small [ 524.524029] kernel msg: ebtables bug: please report to author: target size too small 02:24:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:57 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:57 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 524.609915] binder_alloc: 27195: binder_alloc_buf size 4893816 failed, no address space [ 524.637785] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:24:57 executing program 5: r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 524.666140] kernel msg: ebtables bug: please report to author: bad policy 02:24:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 524.710690] kernel msg: ebtables bug: please report to author: target size too small [ 524.720102] binder_alloc: binder_alloc_mmap_handler: 27195 20a00000-20e00000 already mapped failed -16 [ 524.774815] binder: BINDER_SET_CONTEXT_MGR already set [ 524.799833] binder: 27195:27196 ioctl 40046207 0 returned -16 [ 524.807003] kernel msg: ebtables bug: please report to author: bad policy [ 524.817391] binder_alloc: 27195: binder_alloc_buf, no vma 02:24:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000fffffdfd000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:57 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:57 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) 02:24:57 executing program 5: r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 3: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 524.917803] kernel msg: ebtables bug: please report to author: target size too small [ 524.938113] binder_alloc: 27234: binder_alloc_buf size 4893816 failed, no address space 02:24:57 executing program 3: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:58 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:58 executing program 5: r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:58 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 525.059740] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 525.086444] kernel msg: ebtables bug: please report to author: target size too small 02:24:58 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:58 executing program 3: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 525.130058] binder_alloc: binder_alloc_mmap_handler: 27234 20a00000-20e00000 already mapped failed -16 [ 525.218239] binder_alloc: 27234: binder_alloc_buf, no vma [ 525.230027] kernel msg: ebtables bug: please report to author: target size too small [ 525.240456] binder: BINDER_SET_CONTEXT_MGR already set 02:24:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000002000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:24:58 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:24:58 executing program 5: r0 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:24:58 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x348, &(0x7f0000000480)=""/195}, 0x48) 02:24:58 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 525.273512] binder: 27234:27257 ioctl 40046207 0 returned -16 [ 525.376178] binder_alloc: 27271: binder_alloc_buf size 4893816 failed, no address space [ 525.439080] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 525.467913] kernel msg: ebtables bug: please report to author: target size too small [ 525.509071] binder_alloc: binder_alloc_mmap_handler: 27271 20a00000-20e00000 already mapped failed -16 [ 525.573356] binder: BINDER_SET_CONTEXT_MGR already set [ 525.579282] binder: 27271:27272 ioctl 40046207 0 returned -16 [ 525.592369] binder_alloc: 27271: binder_alloc_buf, no vma [ 526.683839] device bridge_slave_1 left promiscuous mode [ 526.689315] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.754379] device bridge_slave_0 left promiscuous mode [ 526.759836] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.917702] device hsr_slave_1 left promiscuous mode [ 526.958817] device hsr_slave_0 left promiscuous mode [ 527.018903] team0 (unregistering): Port device team_slave_1 removed [ 527.030839] team0 (unregistering): Port device team_slave_0 removed [ 527.041794] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 527.068115] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 527.137834] bond0 (unregistering): Released all slaves [ 527.512584] IPVS: ftp: loaded support on port[0] = 21 [ 527.605912] chnl_net:caif_netlink_parms(): no params data found [ 527.666079] bridge0: port 1(bridge_slave_0) entered blocking state [ 527.672506] bridge0: port 1(bridge_slave_0) entered disabled state [ 527.686514] device bridge_slave_0 entered promiscuous mode [ 527.698244] bridge0: port 2(bridge_slave_1) entered blocking state [ 527.706933] bridge0: port 2(bridge_slave_1) entered disabled state [ 527.719040] device bridge_slave_1 entered promiscuous mode [ 527.748393] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 527.765575] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 527.792375] team0: Port device team_slave_0 added [ 527.804287] team0: Port device team_slave_1 added [ 527.882384] device hsr_slave_0 entered promiscuous mode [ 527.963573] device hsr_slave_1 entered promiscuous mode [ 528.050597] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.057061] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.063728] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.070085] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.131449] 8021q: adding VLAN 0 to HW filter on device bond0 [ 528.151313] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 528.166890] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.189320] bridge0: port 2(bridge_slave_1) entered disabled state [ 528.209086] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.226594] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 528.239644] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.246050] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.271635] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 528.287268] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.293733] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.314637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 528.322603] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 528.331080] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 528.339318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 528.348436] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 528.356363] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 528.364234] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 528.371816] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 528.380287] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 528.392914] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 528.412529] 8021q: adding VLAN 0 to HW filter on device batadv0 02:25:01 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:01 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:01 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:25:01 executing program 5: r0 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:01 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000003000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) [ 528.447716] kernel msg: ebtables bug: please report to author: bad policy 02:25:01 executing program 3: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 528.492594] kernel msg: ebtables bug: please report to author: target size too small [ 528.502167] binder_alloc: 27298: binder_alloc_buf size 4893816 failed, no address space 02:25:01 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 528.547582] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 528.578159] kernel msg: ebtables bug: please report to author: bad policy 02:25:01 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:25:01 executing program 5: r0 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:01 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 528.615176] binder_transaction: 8 callbacks suppressed [ 528.615193] binder: 27298:27299 transaction failed 29201/-28, size 4893815-0 line 3035 [ 528.634964] kernel msg: ebtables bug: please report to author: target size too small 02:25:01 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 528.682898] binder_alloc: binder_alloc_mmap_handler: 27298 20a00000-20e00000 already mapped failed -16 02:25:01 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x0, 0x0, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:25:01 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 528.768257] kernel msg: ebtables bug: please report to author: target size too small [ 528.778477] binder: BINDER_SET_CONTEXT_MGR already set [ 528.787880] kernel msg: ebtables bug: please report to author: bad policy 02:25:01 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 528.814174] binder: 27298:27299 ioctl 40046207 0 returned -16 [ 528.823347] binder_alloc: 27298: binder_alloc_buf, no vma [ 528.851721] binder: 27298:27320 transaction failed 29189/-3, size 4893815-0 line 3035 [ 528.854908] binder_release_work: 7 callbacks suppressed 02:25:01 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, 0x0, 0x0, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 528.854915] binder: undelivered TRANSACTION_ERROR: 29201 02:25:01 executing program 5: socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 528.938865] binder: undelivered TRANSACTION_ERROR: 29189 [ 528.969610] kernel msg: ebtables bug: please report to author: target size too small 02:25:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000004000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:02 executing program 1: r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:02 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, 0x0, 0x0, 0xc3, &(0x7f0000000480)=""/195}, 0x48) 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 5: socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, 0x0, 0x0, 0xc3, &(0x7f0000000480)=""/195}, 0x48) [ 529.105366] kernel msg: ebtables bug: please report to author: bad policy [ 529.136490] kernel msg: ebtables bug: please report to author: target size too small 02:25:02 executing program 5: socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 1: r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 529.169368] binder_alloc: 27365: binder_alloc_buf size 4893816 failed, no address space [ 529.229727] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 529.255294] kernel msg: ebtables bug: please report to author: bad policy [ 529.267193] binder: 27365:27366 transaction failed 29201/-28, size 4893815-0 line 3035 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) [ 529.295921] binder_alloc: binder_alloc_mmap_handler: 27365 20a00000-20e00000 already mapped failed -16 [ 529.342552] binder: BINDER_SET_CONTEXT_MGR already set [ 529.358463] binder: 27365:27366 ioctl 40046207 0 returned -16 02:25:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000005000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:02 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x258) 02:25:02 executing program 1: r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:02 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.415147] kernel msg: ebtables bug: please report to author: target size too small [ 529.423678] binder_alloc: 27365: binder_alloc_buf, no vma [ 529.429420] binder: 27365:27389 transaction failed 29189/-3, size 4893815-0 line 3035 [ 529.447947] binder: undelivered TRANSACTION_ERROR: 29201 [ 529.455095] binder: undelivered TRANSACTION_ERROR: 29189 02:25:02 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x18, 0x10}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) 02:25:02 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.532031] kernel msg: ebtables bug: please report to author: bad policy [ 529.551540] binder_alloc: 27403: binder_alloc_buf size 4893816 failed, no address space [ 529.559723] kernel msg: ebtables bug: please report to author: target size too small 02:25:02 executing program 1: connect$vsock_dgram(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:02 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x258) 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.596663] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 529.673702] binder: 27403:27404 transaction failed 29201/-28, size 4893815-0 line 3035 [ 529.692479] kernel msg: ebtables bug: please report to author: bad policy 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.717199] binder_alloc: binder_alloc_mmap_handler: 27403 20a00000-20e00000 already mapped failed -16 [ 529.760772] binder: BINDER_SET_CONTEXT_MGR already set [ 529.793291] binder: 27403:27404 ioctl 40046207 0 returned -16 [ 529.817970] binder_alloc: 27403: binder_alloc_buf, no vma [ 529.823971] binder: 27403:27431 transaction failed 29189/-3, size 4893815-0 line 3035 [ 529.832222] binder: undelivered TRANSACTION_ERROR: 29201 02:25:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000006000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:02 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x258) 02:25:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 2: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 1: connect$vsock_dgram(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.840763] binder: undelivered TRANSACTION_ERROR: 29189 02:25:02 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:02 executing program 2: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.899910] kernel msg: ebtables bug: please report to author: bad policy [ 529.919186] kernel msg: ebtables bug: please report to author: bad policy 02:25:02 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 529.970806] binder_alloc: 27449: binder_alloc_buf size 4893816 failed, no address space [ 529.993296] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 529.996461] kernel msg: ebtables bug: please report to author: bad policy 02:25:03 executing program 1: connect$vsock_dgram(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 530.030240] binder: 27449:27450 transaction failed 29201/-28, size 4893815-0 line 3035 [ 530.087578] kernel msg: ebtables bug: please report to author: bad policy [ 530.101313] kernel msg: ebtables bug: please report to author: bad policy [ 530.111032] binder_alloc: binder_alloc_mmap_handler: 27449 20a00000-20e00000 already mapped failed -16 [ 530.152780] binder: BINDER_SET_CONTEXT_MGR already set [ 530.169531] binder: 27449:27450 ioctl 40046207 0 returned -16 02:25:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000007000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 2: socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:03 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 530.193080] binder_alloc: 27449: binder_alloc_buf, no vma [ 530.201580] binder: undelivered TRANSACTION_ERROR: 29201 [ 530.207688] binder: 27449:27475 transaction failed 29189/-3, size 4893815-0 line 3035 [ 530.226639] binder: undelivered TRANSACTION_ERROR: 29189 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 530.250878] kernel msg: ebtables bug: please report to author: bad policy [ 530.279805] kernel msg: ebtables bug: please report to author: bad policy 02:25:03 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 530.304691] kernel msg: ebtables bug: please report to author: bad policy [ 530.319490] binder_alloc: 27497: binder_alloc_buf size 4893816 failed, no address space 02:25:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 530.354373] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 530.403714] kernel msg: ebtables bug: please report to author: bad policy [ 530.418921] binder: 27497:27500 transaction failed 29201/-28, size 4893815-0 line 3035 [ 530.434790] kernel msg: ebtables bug: please report to author: bad policy [ 530.528158] binder_alloc: binder_alloc_mmap_handler: 27497 20a00000-20e00000 already mapped failed -16 [ 530.572900] binder: BINDER_SET_CONTEXT_MGR already set [ 530.578636] binder: 27497:27500 ioctl 40046207 0 returned -16 [ 530.593139] binder_alloc: 27497: binder_alloc_buf, no vma 02:25:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000a000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) 02:25:03 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 530.618769] binder: 27497:27526 transaction failed 29189/-3, size 4893815-0 line 3035 [ 530.622051] binder: undelivered TRANSACTION_ERROR: 29201 [ 530.632577] binder: undelivered TRANSACTION_ERROR: 29189 [ 530.660221] kernel msg: ebtables bug: please report to author: Wrong len argument 02:25:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x258) [ 530.676540] kernel msg: ebtables bug: please report to author: bad policy 02:25:03 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) [ 530.727021] binder_alloc: 27544: binder_alloc_buf size 4893816 failed, no address space 02:25:03 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 530.793787] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 530.809836] kernel msg: ebtables bug: please report to author: Wrong len argument [ 530.818869] kernel msg: ebtables bug: please report to author: bad policy [ 530.827870] binder_alloc: binder_alloc_mmap_handler: 27544 20a00000-20e00000 already mapped failed -16 [ 530.866049] binder: BINDER_SET_CONTEXT_MGR already set [ 530.879215] binder: 27544:27548 ioctl 40046207 0 returned -16 [ 530.901686] binder_alloc: 27544: binder_alloc_buf, no vma 02:25:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000012000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:03 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x258) 02:25:03 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) 02:25:03 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:03 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 530.926411] kernel msg: ebtables bug: please report to author: bad policy 02:25:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 530.994339] kernel msg: ebtables bug: please report to author: Wrong len argument [ 531.000931] kernel msg: ebtables bug: please report to author: bad policy [ 531.029210] binder_alloc: 27583: binder_alloc_buf size 4893816 failed, no address space 02:25:04 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x258) [ 531.082197] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 531.098379] kernel msg: ebtables bug: please report to author: bad policy 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 531.125023] kernel msg: ebtables bug: please report to author: bad policy [ 531.145558] binder_alloc: binder_alloc_mmap_handler: 27583 20a00000-20e00000 already mapped failed -16 [ 531.163669] kernel msg: ebtables bug: please report to author: bad policy 02:25:04 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 531.189437] binder: BINDER_SET_CONTEXT_MGR already set [ 531.210325] kernel msg: ebtables bug: please report to author: bad policy [ 531.217553] binder: 27583:27584 ioctl 40046207 0 returned -16 02:25:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000048000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:04 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 531.252884] kernel msg: ebtables bug: please report to author: bad policy [ 531.286186] kernel msg: ebtables bug: please report to author: bad policy 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, 0x0, &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x118, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 531.367847] binder_alloc: 27618: binder_alloc_buf size 4893816 failed, no address space [ 531.400346] kernel msg: ebtables bug: please report to author: bad policy 02:25:04 executing program 0: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 531.416061] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:25:04 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 531.459876] binder_alloc: binder_alloc_mmap_handler: 27618 20a00000-20e00000 already mapped failed -16 [ 531.477143] kernel msg: ebtables bug: please report to author: bad policy [ 531.485714] kernel msg: ebtables bug: please report to author: bad policy [ 531.492894] kernel msg: ebtables bug: please report to author: bad policy [ 531.500332] binder: BINDER_SET_CONTEXT_MGR already set 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) [ 531.516360] kernel msg: ebtables bug: please report to author: bad policy [ 531.533009] binder: 27618:27619 ioctl 40046207 0 returned -16 02:25:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000004c000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:04 executing program 0: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 531.585673] kernel msg: ebtables bug: please report to author: Wrong len argument 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) [ 531.630399] kernel msg: ebtables bug: please report to author: bad policy 02:25:04 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:25:04 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 531.685580] kernel msg: ebtables bug: please report to author: bad policy [ 531.707795] binder_alloc: 27659: binder_alloc_buf size 4893816 failed, no address space 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:04 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 531.729172] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 531.737486] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) [ 531.769283] binder_alloc: binder_alloc_mmap_handler: 27659 20a00000-20e00000 already mapped failed -16 02:25:04 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), 0x0}, 0x258) [ 531.789484] kernel msg: ebtables bug: please report to author: Wrong len argument [ 531.814525] binder: BINDER_SET_CONTEXT_MGR already set 02:25:04 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 531.861711] binder: 27659:27662 ioctl 40046207 0 returned -16 [ 531.875463] kernel msg: ebtables bug: please report to author: Wrong len argument [ 531.884554] kernel msg: ebtables bug: please report to author: bad policy [ 531.890325] kernel msg: ebtables bug: please report to author: bad policy [ 531.903877] binder_alloc: 27659: binder_alloc_buf, no vma [ 531.914883] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:25:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000060000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:04 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:05 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 532.035746] kernel msg: ebtables bug: please report to author: bad policy 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 532.087353] binder_alloc: 27700: binder_alloc_buf size 4893816 failed, no address space [ 532.110956] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 532.124706] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 4194304 (num: 1 largest: 4194304) 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 532.144508] kernel msg: ebtables bug: please report to author: bad policy [ 532.161216] kernel msg: ebtables bug: please report to author: bad policy [ 532.169239] binder_alloc: binder_alloc_mmap_handler: 27700 20a00000-20e00000 already mapped failed -16 [ 532.249398] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher [ 532.269126] binder: BINDER_SET_CONTEXT_MGR already set [ 532.284181] kernel msg: ebtables bug: please report to author: bad policy [ 532.302514] binder: 27700:27704 ioctl 40046207 0 returned -16 02:25:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000068000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:25:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:05 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 532.433310] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher [ 532.445480] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 532.453159] kernel msg: ebtables bug: please report to author: bad policy [ 532.491150] binder: BINDER_SET_CONTEXT_MGR already set 02:25:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:05 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x90, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x108) 02:25:05 executing program 0: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 532.512809] binder_alloc: 27751: binder_alloc_buf, no vma [ 532.533325] binder: 27751:27760 ioctl 40046207 0 returned -16 02:25:05 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 0: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x27, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000006c000000000000000000000000000087004408000000000089ad77ac4a"], 0x0, 0x10000000, 0x0}) 02:25:05 executing program 0: clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) 02:25:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) [ 532.645323] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 532.754729] binder: BINDER_SET_CONTEXT_MGR already set [ 532.760089] binder: 27789:27790 ioctl 40046207 0 returned -16 02:25:05 executing program 1: connect$vsock_dgram(0xffffffffffffffff, &(0x7f00000000c0)={0x28, 0x0, 0x0, @reserved}, 0x10) r0 = socket$inet6(0xa, 0x4000000080002, 0x0) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @local, 0x6}, 0x1c) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x10000000000001, &(0x7f0000000140)=0xa, 0x4) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x0) 02:25:05 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x170, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0x70, 0xa8, 0xe0}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x1e8) [ 532.803573] binder_alloc: 27789: binder_alloc_buf, no vma 02:25:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000580)=@nat={'%at\x00', 0x19, 0x1, 0x1e0, [0x20000380, 0x0, 0x0, 0x20000500, 0x20000530], 0x0, &(0x7f0000000040), &(0x7f0000000380)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x1d, 0x0, 0x0, 'team_slave_0\x00', 'bridge_slave_0\x00', 'bond_slave_1\x00', 'veth1_to_bridge\x00', @empty, [], @dev, [], 0xe0, 0x12f, 0x150, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local, [], 0x0, 0x0, 0x0, 0x0, @local}}}}]}, [@snat={'snat\x00', 0x10, {{@local}}}]}, @snat={'snat\x00', 0x10, {{@random="5f5a1fad6899"}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1}]}, 0x258) [ 532.880314] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 533.774021] device bridge_slave_1 left promiscuous mode [ 533.779525] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.834281] device bridge_slave_0 left promiscuous mode [ 533.839735] bridge0: port 1(bridge_slave_0) entered disabled state [ 533.975933] device hsr_slave_1 left promiscuous mode [ 534.016858] device hsr_slave_0 left promiscuous mode [ 534.068678] team0 (unregistering): Port device team_slave_1 removed [ 534.079511] team0 (unregistering): Port device team_slave_0 removed [ 534.089894] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 534.127402] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 534.220570] bond0 (unregistering): Released all slaves [ 534.418602] WARNING: CPU: 0 PID: 1039 at net/batman-adv/multicast.c:371 batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.428782] Kernel panic - not syncing: panic_on_warn set ... [ 534.434654] CPU: 0 PID: 1039 Comm: kworker/u4:3 Not tainted 5.0.0-rc8+ #1 [ 534.441808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 534.451151] Workqueue: bat_events batadv_mcast_mla_update [ 534.456689] Call Trace: [ 534.459270] dump_stack+0x172/0x1f0 [ 534.462879] ? batadv_mcast_mla_update+0x1920/0x1ec0 [ 534.467978] panic+0x2cb/0x65c [ 534.471179] ? __warn_printk+0xf3/0xf3 [ 534.475070] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.480159] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 534.485678] ? __warn.cold+0x5/0x45 [ 534.489320] ? __warn+0xe8/0x1d0 [ 534.492671] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.497755] __warn.cold+0x20/0x45 [ 534.501287] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.506407] report_bug+0x263/0x2b0 [ 534.510019] do_error_trap+0x11b/0x200 [ 534.513893] do_invalid_op+0x37/0x50 [ 534.517589] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.522674] invalid_op+0x14/0x20 [ 534.526126] RIP: 0010:batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.531817] Code: 00 0f 85 95 05 00 00 4c 3b ad d0 fe ff ff 4c 89 ef 4d 8b 65 00 0f 85 a0 fb ff ff e8 23 29 89 fa e9 a6 ef ff ff e8 19 29 89 fa <0f> 0b e9 64 ec ff ff e8 0d 29 89 fa 8b b5 a8 fe ff ff 31 ff e8 80 [ 534.550700] RSP: 0018:ffff8880a8137bc0 EFLAGS: 00010293 [ 534.556046] RAX: ffff8880a82ee640 RBX: 0000000000000001 RCX: ffffffff86e6a269 [ 534.563296] RDX: 0000000000000000 RSI: ffffffff86e6b607 RDI: 0000000000000007 [ 534.570545] RBP: ffff8880a8137d30 R08: ffff8880a82ee640 R09: ffff8880a82eef08 [ 534.577794] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a8137c98 [ 534.585052] R13: ffff8880a0b35990 R14: 0000000000000000 R15: ffff8880a8137d08 [ 534.592311] ? batadv_mcast_mla_update+0x589/0x1ec0 [ 534.597326] ? batadv_mcast_mla_update+0x1927/0x1ec0 [ 534.602418] ? __check_heap_object+0x90/0xb3 [ 534.608909] ? batadv_mcast_querier_log.isra.0+0x140/0x140 [ 534.614529] ? check_preemption_disabled+0x48/0x290 [ 534.619545] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 534.624990] process_one_work+0x98e/0x1790 [ 534.629213] ? pwq_dec_nr_in_flight+0x320/0x320 [ 534.633865] ? lock_acquire+0x16f/0x3f0 [ 534.637921] worker_thread+0x98/0xe40 [ 534.641709] kthread+0x357/0x430 [ 534.645073] ? process_one_work+0x1790/0x1790 [ 534.649556] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 534.655099] ret_from_fork+0x3a/0x50 [ 534.660043] Kernel Offset: disabled [ 534.663733] Rebooting in 86400 seconds..