[....] Starting enhanced syslogd: rsyslogd[ 14.651105] audit: type=1400 audit(1574876322.314:4): avc: denied { syslog } for pid=1922 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.228' (ECDSA) to the list of known hosts. 2019/11/27 17:38:53 fuzzer started 2019/11/27 17:38:55 dialing manager at 10.128.0.26:37417 2019/11/27 17:38:55 syscalls: 1351 2019/11/27 17:38:55 code coverage: enabled 2019/11/27 17:38:55 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/11/27 17:38:55 extra coverage: extra coverage is not supported by the kernel 2019/11/27 17:38:55 setuid sandbox: enabled 2019/11/27 17:38:55 namespace sandbox: enabled 2019/11/27 17:38:55 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/27 17:38:55 fault injection: kernel does not have systematic fault injection support 2019/11/27 17:38:55 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/27 17:38:55 net packet injection: enabled 2019/11/27 17:38:55 net device setup: enabled 2019/11/27 17:38:55 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/27 17:38:55 devlink PCI setup: PCI device 0000:00:10.0 is not available 17:39:22 executing program 1: pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f0000000140)={{}, {}, [{0x2, 0xa}]}, 0x2c, 0x0) close(r2) r5 = socket(0x11, 0x800000003, 0x8) bind(r5, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfffffe14) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 17:39:22 executing program 0: unshare(0x28a7ff05a493e992) 17:39:22 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') close(r0) 17:39:22 executing program 2: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x1, 0x0) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000040)={0x18}, 0x18) 17:39:22 executing program 3: 17:39:22 executing program 4: r0 = perf_event_open(&(0x7f0000000280)={0x1, 0x2b4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) 17:39:23 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xf4X#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f0000000b00)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xedV\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\x1c{7\xa2\xdd\x8f\x112*\xf6\x8a\x94\xb5\xa1\x03\xc5\x0f\x00'/386) pipe(&(0x7f0000000440)) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r1, 0x203ffffd, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000080)={0xf}, 0x20000357) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x400000, 0x0) madvise(&(0x7f00000d9000/0x600000)=nil, 0x600000, 0x8) 17:39:23 executing program 3: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$security_capability(0x0, &(0x7f0000000100)='security.capability\x00', 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000100)={@multicast1, @local, 0x0, 0x2}, 0x134) 17:39:23 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt(r0, 0xff, 0x1, &(0x7f0000000040)="18", 0x1) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0x4, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev}}}}}}, 0x0) 17:39:23 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) socket$inet6(0xa, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) 17:39:23 executing program 5: r0 = socket(0x2, 0x80805, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000080)={'broute\x00'}, &(0x7f0000000000)=0x78) 17:39:23 executing program 3: r0 = socket(0x1f, 0x3, 0x0) sendmsg$unix(r0, &(0x7f0000000740)={&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0xa, 0x0, 0x0, &(0x7f0000000640)=[@rights], 0x18}, 0x20d) syzkaller login: [ 55.953510] keychord: unsupported version 24 17:39:24 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffc61) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg(r0, &(0x7f0000000140)={0x0, 0x100000039, &(0x7f0000000000)=[{&(0x7f0000000380)=""/110, 0xffffffd9}], 0x1, 0x0, 0x4a}, 0x0) close(r1) 17:39:24 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x10400003) 17:39:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000840)={0xffffffffffffffff}) sendmsg(r0, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x801) 17:39:24 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="cfd80000000001040000007a14668d5150be3537"], 0x14) r3 = socket$inet(0x2, 0x3, 0x83) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 17:39:24 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000)=')et\x02\x16\x00W\xca\xdad\x8dt0:loppp0\x00', 0x0) write(r0, &(0x7f0000000280)='&', 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) r4 = dup2(r0, r3) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r4, 0x0) io_setup(0x2, &(0x7f0000000140)) 17:39:24 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') syz_open_procfs(0x0, &(0x7f0000000380)='fd/4\x00\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$nV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\xc6\x96Y\xf7\xd3`\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/376) 17:39:24 executing program 2: r0 = socket(0x1f, 0x3, 0x0) sendmsg$unix(r0, &(0x7f0000000740)={&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0xa, 0x0, 0x0, &(0x7f0000000640)=[@rights], 0x10}, 0x20d) 17:39:24 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) 17:39:24 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername(r0, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f00000001c0)=0x80) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, 0x0) 17:39:24 executing program 0: r0 = open(&(0x7f0000000180)='./file1\x00', 0x60e, 0x0) pwritev(r0, &(0x7f0000000000)=[{&(0x7f00000001c0)="f6", 0x1}], 0x1, 0x0) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x5, 0x10, r0, 0x0) nanosleep(&(0x7f0000000040), 0x0) 17:39:24 executing program 2: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x29c}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000280)=@nat={'nat\x00', 0x19, 0x4, 0x0, [0x200008c0, 0x0, 0x0, 0x20000afc, 0x20000b2c], 0x0, 0x0}, 0x50) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x50, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = creat(&(0x7f00000001c0)='./file0/bus\x00', 0x6857b21ff1155d90) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = dup(0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x10000000000f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, 0x0, 0x0) fchdir(r1) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000340)=ANY=[@ANYRES16], 0x2) sendfile(r3, r3, &(0x7f0000000240), 0x7fff) 17:39:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 17:39:25 executing program 1: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="95000100000000000001040000000000"], 0x10) r3 = socket$inet(0x2, 0x3, 0x83) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f0000000140)=0x7ff, 0x4) write$binfmt_misc(r1, &(0x7f0000000280)={'syz1', "6b4bb5f5e0f9c8b831a3294f99cf54fc9053e7547dcb443b15042874a8d3f901475a0cdbeeff59f9611934041592e83250f6d21bf87daa0f14991184ab2c9310630253621511172f6058d5c0c112228355f57373b3133189bdcdd1a7dfe590fdf216cbc3ef4720297d46e14c4bc03f2b502f7e3ac8ee5ae5067e691f4662d818493ad89a64b01fa754b4fa66dcc71b03a14b8a3b43a2eb1f91a80bb3857443619d3ed1556a91cde475ef4ad51e6c2f9bd28f3fd2ea8c6cd9247aa0fb1401c49d9c6e276fd86614ac31209637d5bb91a806b94bb21e347541c80a0262410f8ed92c5222fbe8be885a636832fb7aa0b74ff84687270e1a6170e59b6db9ec2476e7d8450fe95874bc59e14e547456b0c9e1056b5de156efd42eadb7918d8e8365b3ea9ec71412023ddbf1f0ef7d712e6d09a93fb3ddcb66138cea32f725d780f37d01a1390ff820fd4fac7792d7da339bb0955fa313864bf0baff3a47d7980a2cee312548d66b2c9f57c90cb801b15f7c7c61cad8d83ee52dcc2bdcfb67f7b236dc84d316802f0917be27d7208ee8cd58e9d27d18c0ab3f22de66545af5d4dccf5a03f712b635252f3cfe7a210b1460eaa00d4fe4faa7db7ae7dfea428de159528357a490e28d3ceb96dbe96b9732d2e1250c670e6eb6f7ac013c51809bd7b759b1f5acc5f5f38ea882fa60ac3ab83c62c2a69f338599b73909b54caf5a25ffe1d77f564b6111b805e91401adfd1d75f15d50304fe723df07520390dd964e0ec3636b4290cf77c8b7305b27248189de447fe0aae95db38c537ee02b0321edb04fcde09eb22e716a6632e2f919b3133be88578ac20850e8774fff1710d430c4a6807fc4a55840d4e03225d2989e1a6ec07bd42187ac5a1af68b45bf18061d5ab60c3d76ea5c7d797de8fe65fe110fadfe487d356ee0ffdd9192b57395ccbba7bddbceb26e02dd1c36f82363b141b07f75f2550776bc6c967aeec0acf2100f0a55edcb6d913d442c804f82ec1368e4d2185a2b3d6de59d1e721f2144408b1f90aea2a5fe502731fd59e00b536b85d63f3bafafc80e80997deae3a2a051432affc9dff0177f59e16669caff80022cec7559bb467be2836ee7e922a64b4fdc1fee1128ecc779f274e378c38739ac7b251e0b7ca1db7f4af04ec0a803a5d89669118b771d203a5d21c3be6b7e712277ec2a4ff481467c6c148d2db4cce50b305d78923c1cb889578f9cbe0554d45e564f4d62b6d72592bab73e17cb1d9efb618640ba0f15b0a2c8cc7df8a59a54b6ef18f43b50a038a4c712deb24c8c2de84b891ee5de5290d66e72ffb29c6a3ea1037fe562c721b8f3a6678c27e6ebd7e12ac2633e6914b984dd6f269be78f8c2d1d3606d21bfa78fb252b9709430d429282e4084fe0976ca560d62e8a649ca34d3f07f51f4bda877a6aeb341b305540f2b8d3a334dbef20e361d2ec61bacb44b112992999dab4fe6729d79914e7c993a8d042719d9f258f7a1b672d9146d13cf4b2f94e0061ff5dae6561ffa38c98af4359e6aab91ad76e2ade83dad6f04e1e79842a2f3db5e1005883f8956449b03966d4c7da37b7f9e60c9d77a4ebbef4d7b4dd07bc9e673f21b6fb858011de4e52bdc3473b83a96b00329a2742a12d8d8fe7140f6a98b809b4467e0181b5d6b85a86d5ca2df1096a8b5b9bddc941d07c2db9197f47a73d6924a92746ea3fa1a37b12e1d81675d28bd711347b47ce4db97465fb9992df128a9c55def865a1d1a6a7924a67ec130f92d4d5689ea97007b8fb639230e240cd26065da53e77b14fe8226008e6c5d0de0e488a5777122c3ea40692b338499589d355dd5ff84ddb3257bd54c02cef076538563bab5657e8a7c3dd0c9db25adbb8dc93750729e94cc29b11c81443a7e0b6604f84e052bbdfaeeff4351999124a58e2d5eeb44c7ebe7990af51a483e40f2dcd505a49fa526053d9b266434a21958e23dc796b7560c781fa44a3d4cb28d57b2ea9242bdf0e43a917eadde2d152a82574ea5b22d8f7eab4c3662640258ae1a5e834116831bffd2447eac272f00a12725fe6e77028fb7e0eb5775e16921173b3f5f27c38c3f4ff948601c1522f3acd5d082e91c8629302dbeca4e5fc4c5391e4c32d65125ce11b4c365d96bb3e934cb33837abe84740e60c25a146eca116c0a36dfc64c0a4e1142b7e8935dffe498d0296f1eee1d3af0918068531551676a2ba4368334c7684356abe84ca8ac6ff0b01de337b57325faae5fa666ff096024b632581f45b35b44dd965e840d00962e3cb3deaaa60146dfc34ffe2bd08bccdfe3989c637c1a0be2979be51b1eade1dbeb42c248a21d31f3a29e77292a8c4d7b0bb1dade7d08916b798ceff07ad12db9ad4d8dd0e862b828adc585b44b48d9a7d7f93afb8df0dafe828c34cea407f5340c2b640c80a0d9609ad5dbebf8a5d37c21c585c746f1514ba72e67a4455c32088a2e5acfe01b8d5d33df743c5188da2e4386d3ab8c90b13b0906bd3b8e566d50baba919ab66a402c7c396cd3350d92faca73e93d379a189215229eebac624485429c80723abbad492c796916b1df6742c18e9a8366a3991fcb29c7c80daf7f5893d4699372bb22865dc0250cf3276ea0e9de6b3ac1a00b26753e15df8a0d2e6cf6169732732d2f6f4260bc5f12795ea30e203c832218230aca04b8295f5425257d19f6726301f7be071370321eed9e582f71a57dfd089bbb70e06f40044f390908d4e82a511b9c5d952ba97035b450381fb245dcd5141fb217ad08d74ddd6d7f350458264055dcc1988c824e16e347e810e13108ac26c7de9d36fc401f9abe2b5f5e8d1b7f9cfdca6b4b79a5f1f8ea8abb75c19d8dd000c8eeb18c526a66b35d85912b86d91c0f5c883f68213de70488ae3efba81ed26a1271fbe5930236afba1fc8e1603fc651f87e6d987f54ce7980c4a2c443fe7a0ba7928c967e39a58c3c124377b70a90d3c7dd9677278cd2e89ea4c6abbbb941ccd749c39a90c0dd5b39d46d5829be36af6be8cf5283aa9b7938a3d6dde43cc13e71272bf41a5ff7122ecd7d3f2aa15d08b48b3357ce7bc6bf50c9b39c2b3acc444d6af06019df8ede4e7612a85af023024a1a16476e4a6473f03b60f42eddac607af4f3b0b671cbe28debfe5decdd1cf4e30215d9d86319bc5017d268d4404b37735d7ea8a0fbf8bf332ad32ad325dd1a6a7d155f26cd6c16cadd3a3d0a24110777565a3cf3771eb197d84945a9ff45f9ae8d7465d89b430d8a56bf8db976b31b91e9bd0e0d28331b10b3124b7c49f73305e84ce6de38d6b3d080a49027519112f927e612dedc87d604af1e71a45f8cd73f8607c9e70714d3cfc3e5ee0347bbcbdccd9ad2067df922a35836606126f96d4910b596cf9d53d725acbdab8fc4d7c8c58e86bbffe6ef20bcd5244817a0ea0b6aea9042a5fac639d4bc6701a5cd3a7cd4dd53fb647dfa1e522532470fe65c52a20e8ffc54404d2ec72ce14c6afbfc4978882ff6d17b78d16a07d393675b0d1ca2dbb153c330cf6ff1ae278180040126bee7ba3f382d893f3a6a0e44cbd5380a3f87cdb0c78e9951eea4cf5027dcc1988a4aec56637507761f9fc5648f26c16e9da2ffcb71a8c856d04a1d251bbe1ff8105c954bb3b508c3428faee5cd0e5275b31e6b0b25f0701b2cf2e41af7a210d6d13be48d0579f702132f0dc010c44f5b7d45a08b03d6c612927970bbfe755f54c6f01359344dbb715861ee6cc71f5618541c36bc10ee8182d1e154df7e34900cde44f64999064c0df7ee8e1eeb5616d04732270610cd5f70e55e9a684791ab919ef7800f7b4a86034b17341e0b35a1015a6a557a87376598c319d0ee0050b2349c65a820bc319c860235850b0ba0aa673148dbb2a06cf5b17440e4b7d029997e43cecfcbb2ba42fe3c6fed5222dd0cb5b1f13e88bafeecda08ed06397e981986752fe8e78f556ce8c7014d2a414ade0bb2a1915aa0c8e9f8b18093f3423c863b639052b63c3c8b5542cea7090337b202fa26356dafcc7259da14f783261846c6d332c70c071eafa345ff1cb840d4bd7a54e69b0a5b728fc1df4d6c18e421ccc6b1d781930322875eeadbbf1aba446e0ee13b56ebf4785b45c818eea8e37b3ae801112a43e5430a9235e42cd128766795f52b2ad58170ba1d8d9c7eb5707c680ff72d4405e298a4631f04d03ec7d369ea18a5c168178f1d56c631063866c6017ecff53d5cf7815909f1f9793214fabefc4551fc78be0f09c232c0e015cfe2696ff6b803da98908db2869989fb58ba350369d41074c579f417bba37093205d59e19304eda305b51d3fff3b34151fdbeabb95052c3c28dd843415a84eb7253d935693e29762d6199954ff8413fa4f5058291614e416e60cab7c036a50270e045e70e9b4656e9a380cacc3e859c3585f23854ea1e38e9aa06f9e4815504394016d47c5403dfe8062e8ae60a4b2fc3ea5906969b1a3f23ccb7958a90801dad8d93c7f6a778609a0fd3b9ed577febbb635f1ee066d1d4f34555f36841afe2474394d38d1dab9304e7872cd4c9a5c8e7abfd7e65497b948dca9aa36dd8fbfceb4272830db2bfff5b5d20076b7b59ece58bddf569a06b14d4a79042bea45d9f866a4069d403b9b967f0b1d00b0c1decb6be5b2b0a11ebf14a8f80073102001d08d034cd3fbeae38bbe4c7c402eefc27bc9c15fb44ce87f75da6b4de058d02a3566d20f87213d25e96dc46386699ab35a58d0a5c59e6e9438cfccca0e94e33ce323e8ce9cf7e5e096d0290ae8ebf0bc73041bba1062283d1f6d8712149ac921d75b72e598b5368873e40788369f953f918e730c20e9569bddc76a5a9a2ef398f538c4e1f3f9bc67df2fc720bb27501104128adc36a5a0e536d6135616b3cdfa25d4fdfcc421ce79246de4f9a536a0d23ff831b4a11e6ce414a3de3a511bb9b341b0468688bed52bbc6a630895129ca97a1223350a6b3216f46e1118c98ea65d814a93a6e168c54a9791540b390f1616026fcd3afcc96b101c063928aa9c2f774e47d4f5a9dee623a1ac4c5c1f77e15fc9a3f7ed6579bc52fb1bdba2437135272942ca402ea9894477f734743ed9d2033e2f24ce54d91db6e3f97686964749af833cc13f9b7ea2492dc85d7e51a81edf949e59ec3771085aa60fc440c58c5b84ddd05efc4d1450cc43d58ac71250cedf41b2462e7a9de173b050683b9edfee4d65ce22c9a00280b972f661bf5a1f42eee74591eef807ddd24eebdb4324257778200870fbc5eb0a0e806ee2bf19ff0c905384f7824b66055c14c4dd8241ba86e46740667979e25b6b65778c8c9af6cdb5f1e640aff03a61c86788e3bcb19d137682544ea2a081f23bb7f2a9afed408d6214b73b81ac4e85157eedf18a90540e3b8b3bbc060bd6829b5f9578067445f9bef10d1ebb4941972eff4b578339af36af14f1cc28c99079b208cd1b5159f810037fe62121db345ad78ff0fb5f5f84b2cb6ae336c10e9074b335ee1677375725151b68ef71e1b93db7f126c8d08f72a9ee6d98eb2ce722559318f28c046eb54ed74d9f2f12483694c5a7af226a1fe27a044613c1ce50b8c3cbe175b3efa5389348a53574e7680f97b8883ec16f543d5b2612d0142ee5dee774a377f6c42e15e2ea7d3bc3805eed282a7c0780f759e320e3ecc66a903882ee78401b4d1422d6fa1872da4d8662d07d3932d0d226bb8e8fc3eeb6c733a9aca240f82ea99ee302af17890d30854740662812ca48c062ba3bb23711b300a37bc7a98362e696c130264d33bcf05d2577ba973f3dcfc9212ef83a"}, 0x1004) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 17:39:25 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000001780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000040)={0x28}, 0x28) 17:39:25 executing program 0: ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000c40)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6#\xd9\xa1W\x1c\xb96\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\x97\x80\xe9\xa1S\f\xc7?\xa6\x95I\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~\xff\xff\x00\x00#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xd5\x1b\xca\xa9\xc7[\xa2\xef\xacM\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xb4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\x04R\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xafh_\x9c\x91\xc1q_|L\x11\x03\x94\xc0\t=\x17\x95P\xd7\xcdH\x1c8^ARL\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x13\x82Rk\x9cAz\xab\rT\xadLO\f\x17Y\x1dg\x10\xe3LL\x1fC\xfa\xd9\xb0\xfb\xb4\xf3[\xdf\xd0\xd6\x82\xf6~0\xb8\xf4\xb0X\xfew\xbdY\n\xd6\x105\x9c\xb7\xe5F\xc1:9\xb8\xc2\x85\b\xfd\x92\xb0k\x93\xd7\xc40J\xc2\xf0=p\xd6\xe3\xe4W:\xd2\xf6\xfc\x83\xb1\xcb\xd1K\xb9(\"9(~\xf4\xf4\x94`\xe8\xdb\x17\xf9\xcf#)T\xcdj^\xa61\x12\x91 \xd7\x92\xc0\xd0s\xa9\xe4\x18:') socket$packet(0x11, 0x2, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0) r2 = memfd_create(0x0, 0x0) write(r2, 0x0, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x5c) ioctl$TIOCGSOFTCAR(r3, 0x5419, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r4, 0x0, 0xffffffffffffffff) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 17:39:25 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="00038a3c727ce7c83e517add86dd20"], 0xfdef) 17:39:25 executing program 1: socket$inet6(0xa, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x7, 0x63d}, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 17:39:25 executing program 2: perf_event_open(&(0x7f0000000440)={0x2, 0x373, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() tkill(r0, 0x9) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f00000000c0)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x30, 0x3a, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, @mcast2, {[], @icmpv6=@dest_unreach={0x0, 0x0, 0x0, 0x0, [], {0x0, 0x6, "030009", 0x0, 0x0, 0x0, @empty, @empty}}}}}}}, 0x0) 17:39:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000280)=0x7) 17:39:25 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00003fefff)=""/1, 0x1) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000cd8000)=""/1, 0x2e171c03}], 0x1) ioctl$int_in(r2, 0x5452, &(0x7f0000b28000)=0x6) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)) fcntl$setsig(r2, 0xa, 0x12) ioctl$TCSETSF(r0, 0x5404, 0x0) poll(&(0x7f0000b2c000)=[{r3}], 0x1, 0xffffffffffbffff8) dup2(r2, r3) fcntl$setown(r2, 0x8, r1) tkill(r1, 0x16) 17:39:25 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000001780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) statfs(&(0x7f0000000180)='./file0\x00', 0x0) 17:39:25 executing program 2: openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r2, 0x4, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x40000}]) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x100) r4 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r4, r3, 0x0) fcntl$setstatus(r3, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlock(&(0x7f0000704000/0x1000)=nil, 0x1000) munlockall() syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') 17:39:25 executing program 1: mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlock(&(0x7f0000704000/0x1000)=nil, 0x1000) munlockall() 17:39:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') syz_open_procfs(0x0, &(0x7f0000000380)='fd/4/\xa7$\xbf\x05l\xb8\t\xd0\x06\xae\b\x86$nV\x92M%\xfd)0m6Z\x05\xae\xa7\rM\bp\xa6Q\x871B\x973\xfe\x05\x12\xf3\xd496\xf9\x1aM6\xb2|\xc5\x05\xbc\xe71g\xe4<&\xd2\xd8g\xb6\xa2U\xae\x9a\x17F\xa5xi\xe8_\xa8R\x96d\x99\xf6_E\xd0\x8f<\xa840\xd6\x84\xd0\x17\xafP\'\xdc{\b\x94\x00Y+\x18N\xc6\x96Y\xf7\xd3`\\\xc9\x1f\a\xf9X\x125\xb9\xd6\xbf\x1a4V\x10\xa6Uq\xceN\xeb\xa8M\xb2?\xda\xfb\xb1\x9d\x94\x13O\xab\xde\xc0t\x8c\")\x05~\x0f\xb8\xf3\xf6d\xbe\xad\xee\"\xaa\x91\x05\xcb9A\x1a\x8d&\x9e\x81\xcf\x9eWvT\x8a\xbfl\x8a\x83%\xec\x94\xfd\x90\xeb\xb3\xa3\xa8\x90\x90\xdb\xc2X\xf48\xd1\x83Eu\xe5c\xd7\xb7qe\xab\xae\xef*\x9e\x95\xde\xa0\x894r[\\\xc4?\xb7\xcfo\xdb\xbeR\xc5\xbc\xb34\xbe}\xf7n/4}\xbc.t\x94\x1c%\xcb\x93\xea\"Aa(\xd6FX\xd8\b\xd1\x10N{\xe8\xbc)\xc8\x1e6\xff\x95\xa3\xf3\x84\xf4\xa5\xe8f\xc2@\x1f7h\xb3\xd6\xab\x9a\x03\x95>V\\\xc4%T\x94M\xc7`\x83\xa1\xa0\xc8gn\xe3\xfe\xef[\xb3\xbd\x18R\x1b=\xab\x97$\x03\xaa\x84C\x0eWD\xeea\xf5\xb9\x82\xea\xbd5:\"\xf6f/\xa1\x8f%8\xa8\x1e\xcf\xb6\xa7\xe1\x1b1\x94\xc1G\xf9\xfc\xc77\x1c\x00'/376) 17:39:25 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000040)=@get={0x1, &(0x7f0000000000)=""/45, 0x200}) 17:39:25 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="00038a3c727ce7c83e517add86dd20"], 0xfdef) 17:39:25 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @loopback}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x4000010000000013, &(0x7f0000000040)=0x1, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e23}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) r2 = socket$inet(0x2, 0x80001, 0x0) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e23, @loopback}, 0x2f) connect$inet(r0, &(0x7f0000000340)={0x2, 0x4e21, @empty}, 0x10) 17:39:25 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000004c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x0) connect$unix(r0, &(0x7f0000000380)=@abs, 0x6e) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) syz_open_dev$loop(0x0, 0x0, 0x182) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x81805) 17:39:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) 17:39:25 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) 17:39:25 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000001780)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000600)=""/164, 0xa4}], 0x1, 0x0) write$FUSE_INIT(r0, &(0x7f0000000300)={0x50, 0x0, 0x1, {0x7, 0x8, 0x0, 0xffffffff}}, 0x50) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000180)={{}, {}, [], {}, [{}]}, 0x2c, 0x0) 17:39:26 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000100)={'bond0\x00', &(0x7f0000000000)=@ethtool_gstrings={0x1b, 0x0, 0x91, "1ee20a2575fe07f30717da2dc928d863bd0639d6e1ce69908a74704f5cd57fe605dcdd9fff9d1b127272ca92c024244defb73117ef2635789e89dc87f1d480517e1d67a7cc5bdb6560edfbb5d64fa2a593e6c7b2ad3a61e965f5bc2359418f7cd6b27434a6493d6489f267dc4cc55cc0bfcf4c9c9eafebe963ef2d554fe2e273e84ab6e4d5b60997e436a8bd1b871f936a"}}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 17:39:26 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x10400003) 17:39:26 executing program 2: ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000c40)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6#\xd9\xa1W\x1c\xb96\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\x97\x80\xe9\xa1S\f\xc7?\xa6\x95I\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~\xff\xff\x00\x00#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xd5\x1b\xca\xa9\xc7[\xa2\xef\xacM\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xb4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\x04R\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xafh_\x9c\x91\xc1q_|L\x11\x03\x94\xc0\t=\x17\x95P\xd7\xcdH\x1c8^ARL\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x13\x82Rk\x9cAz\xab\rT\xadLO\f\x17Y\x1dg\x10\xe3LL\x1fC\xfa\xd9\xb0\xfb\xb4\xf3[\xdf\xd0\xd6\x82\xf6~0\xb8\xf4\xb0X\xfew\xbdY\n\xd6\x105\x9c\xb7\xe5F\xc1:9\xb8\xc2\x85\b\xfd\x92\xb0k\x93\xd7\xc40J\xc2\xf0=p\xd6\xe3\xe4W:\xd2\xf6\xfc\x83\xb1\xcb\xd1K\xb9(\"9(~\xf4\xf4\x94`\xe8\xdb\x17\xf9\xcf#)T\xcdj^\xa61\x12\x91 \xd7\x92\xc0\xd0s\xa9\xe4\x18:') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) 17:39:26 executing program 0: socket$inet6(0xa, 0x4, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f0000000240)='security.selinux\x00', &(0x7f0000000280)='system_u:object_r:iptables_unit_file_t:s0\x00', 0x2a, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000180)}, {0x0}, {&(0x7f00000003c0)}, {}, {&(0x7f0000000540)="ad173d690e28472bd995e7a8547d81fc4f", 0x11}], 0x5, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40086602, 0x400007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) 17:39:26 executing program 5: r0 = eventfd(0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000540)=[{r0}, {r1}], 0x2, 0x0, 0x0, 0x0) 17:39:26 executing program 3: r0 = socket(0x2, 0x80805, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) 17:39:26 executing program 0: mremap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000007000/0x2000)=nil) mlock(&(0x7f0000009000/0x1000)=nil, 0x1000) 17:39:26 executing program 0: 17:39:26 executing program 2: 17:39:26 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r1, &(0x7f0000000300), 0x121, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x3bc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000005100)=[{{0x0, 0x0, 0x0}}], 0x1ed, 0x0) 17:39:26 executing program 0: perf_event_open(&(0x7f0000000200)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25208, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x8}, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x100}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) creat(&(0x7f0000000300)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000340)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r0 = gettid() tkill(r0, 0x3c) pipe(&(0x7f0000000400)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 17:39:26 executing program 2: r0 = socket$inet(0x2, 0x3, 0x83) setsockopt$inet_int(r0, 0x0, 0x3, 0x0, 0x0) 17:39:26 executing program 3: r0 = memfd_create(&(0x7f0000000000)=')et\x02\x16\x00W\xca\xdad\x8dt0:loppp0\x00', 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) 17:39:27 executing program 4: 17:39:27 executing program 0: 17:39:27 executing program 2: 17:39:27 executing program 5: 17:39:27 executing program 3: 17:39:27 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r1, &(0x7f0000000300), 0x121, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x3bc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000005100)=[{{0x0, 0x0, 0x0}}], 0x1ed, 0x0) 17:39:27 executing program 0: 17:39:27 executing program 3: 17:39:27 executing program 0: 17:39:27 executing program 2: 17:39:27 executing program 4: 17:39:27 executing program 3: 17:39:27 executing program 2: 17:39:27 executing program 5: 17:39:27 executing program 0: 17:39:27 executing program 4: 17:39:27 executing program 2: 17:39:27 executing program 1: 17:39:27 executing program 3: 17:39:27 executing program 5: 17:39:27 executing program 0: rt_sigprocmask(0x0, &(0x7f0000000080)={0xffffffffffffeffa}, 0x0, 0x8) r0 = gettid() tkill(r0, 0x3c) rt_sigtimedwait(&(0x7f00000000c0)={0x7fffffffefffff61}, &(0x7f0000000000), 0x0, 0x8) 17:39:27 executing program 4: 17:39:27 executing program 2: 17:39:27 executing program 4: 17:39:27 executing program 2: 17:39:28 executing program 0: 17:39:28 executing program 5: 17:39:28 executing program 3: 17:39:28 executing program 2: 17:39:28 executing program 1: 17:39:28 executing program 4: 17:39:28 executing program 0: 17:39:28 executing program 3: 17:39:28 executing program 5: 17:39:28 executing program 1: 17:39:28 executing program 2: 17:39:28 executing program 4: 17:39:28 executing program 0: 17:39:28 executing program 1: 17:39:28 executing program 5: 17:39:28 executing program 3: 17:39:28 executing program 3: 17:39:28 executing program 4: 17:39:28 executing program 1: 17:39:28 executing program 2: 17:39:28 executing program 0: 17:39:28 executing program 5: 17:39:28 executing program 4: 17:39:28 executing program 0: 17:39:28 executing program 2: 17:39:28 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000000)=""/110, &(0x7f0000000080)=0x6e) 17:39:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="116348400000000000e400000000000000000000fbd03ad0976e030000004d6ae181b81d77"], 0x0, 0x0, 0x0}) 17:39:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x29, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/25, @ANYPTR, @ANYPTR=&(0x7f0000000200)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x14, 0x0, &(0x7f0000000380)=[@acquire_done={0x40106309, 0x2}], 0x0, 0x0, 0x0}) 17:39:28 executing program 2: 17:39:28 executing program 5: fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) creat(0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) creat(0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x80) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) timerfd_gettime(0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0xfffffffffffffdc6, 0x20000004, &(0x7f0000000280)={0xa, 0x4e22}, 0x1c) write(r1, &(0x7f0000000380), 0xfffffffe) recvfrom$inet6(r1, &(0x7f0000000240)=""/46, 0x1f, 0x100, &(0x7f00000002c0)={0xa, 0x0, 0x6c7, @local}, 0xfffffffffffffedb) r2 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r2, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) [ 60.781018] audit: type=1400 audit(1574876368.444:5): avc: denied { set_context_mgr } for pid=2619 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 60.804905] binder: 2618:2622 BC_ACQUIRE_DONE u0000000000000002 no match 17:39:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000040), 0x4) 17:39:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fstatfs(r0, &(0x7f00000000c0)=""/129) 17:39:28 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001380)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f", 0x2c}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) [ 60.815441] audit: type=1400 audit(1574876368.484:6): avc: denied { call } for pid=2626 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 17:39:28 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:28 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000000)=""/110, &(0x7f0000000080)=0x6e) 17:39:28 executing program 1: 17:39:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001380)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825", 0x1d}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) [ 60.927492] binder: release 2626:2627 transaction 3 out, still active [ 60.931500] binder: BINDER_SET_CONTEXT_MGR already set [ 60.931510] binder: 2626:2645 ioctl 40046207 0 returned -16 17:39:28 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000001900)) r3 = syz_open_pts(r2, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) dup2(r4, r2) close(r3) [ 60.997367] binder: undelivered TRANSACTION_COMPLETE 17:39:28 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair(0x2, 0xa, 0x0, 0x0) 17:39:28 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_nanosleep(0x0, 0x0, &(0x7f00000000c0), 0x0) 17:39:28 executing program 2: syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c795) [ 61.024745] binder: send failed reply for transaction 3, target dead [ 61.104898] syz-executor.4 uses obsolete (PF_INET,SOCK_PACKET) 17:39:29 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) dup2(r1, r0) 17:39:29 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0xa, 0xe23, 0x0, @remote}, 0x1c) 17:39:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$unix(0x1, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_xfrm(r0, &(0x7f0000415fc8)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newsa={0x13c, 0x10, 0x203, 0x0, 0x0, {{@in=@dev, @in=@multicast2}, {@in=@loopback, 0x0, 0x33}, @in6=@mcast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'md5\x00'}}}]}, 0x13c}}, 0x0) 17:39:31 executing program 0: setpriority(0x2, 0x0, 0x9) 17:39:31 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd", 0x3b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:31 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x6000000, 0x100000001, 0x6000000, 0x1}, 0x1c) syz_open_dev$binderN(0x0, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000000), 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f0000000300)='./bus\x00', 0x0) dup2(r3, r0) inotify_init() 17:39:31 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x0, 0x0, 0x102, 0x1, 0x0, 0x0, 0x1}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) dup2(r1, r0) 17:39:31 executing program 3: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17:39:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x8, 0x0, &(0x7f0000000380)=[@acquire={0x40046305, 0x1}], 0x0, 0x0, 0x0}) 17:39:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000000c0)={'syz_tun\x00', {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}) 17:39:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_getres(0x3, &(0x7f0000000080)) 17:39:31 executing program 4: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) write$9p(r1, &(0x7f0000000340)="ff", 0x1) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17:39:31 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000480)=ANY=[@ANYBLOB="621f00000000000081f7f6ac3c4757da1e8e3db67476d158e671cb6be3275f4fa79356c64e25dc26d8f3fd528d72b9a292bc879667d0168de48485242bf87b6edf4eed0b0100e18d79bcd5e741c6442bdc9f6f962fd755b5d266b80300000000000000f4d924d0b0283494245775be4d1cfdf7eb3f9b26ead83d68f24bea46e9f4f486dfc88d864804e3e27dcf61827ab1cb6f23cccd868185d938e1bdfb8bf8c2d895d5801ddc79a56109704eb860f120599ea356d5c8edd693a3309fe2927078fe4b33e1c22664995e2995373922c95fe013c703924e85ca38a48f703dc82174488cd4409afc10e8eb5800000000000000b10f30b78ea6891befa14c55d889963c3c1f9d6c670000000000000000000000000000000000000000e13e00008a5c8caa19af5c85edc0cf1de53b0eb7b90eb6bed40d0f155fdfd901938597449e6a6a4cc236b97deae54a0daa21679d12f79403b827ae031e47b67d85eecf6fb4c19f6808a6971d3acee84ac3a36e0cbc935d17754d3a816078a556a755be101cebdbba75c5cc37e6fb2f8d9aa69ef82864f5274c790559cd9b3435516cb93ee81f35bc29d2734a32261b54ce2fb9de10eed24de5fb38f63d25d0222450d995f18e047ecbb702d098cee938c6bd00f7ad15306e5f000000000000000000000000ade23999922f5099c065ae2c63765614b5037faecdcef6dfae48982829b1ad408caaab135e298603c17fdd5e5761e50b34d79d3b26275c835250f94ade26cd2fcd54b43cccbc5f93523ce5006fb19f156b12894165a346a1b0f9ab7ed2f2b918d453b4a4fa0d560700b6856465b73674762756f815a7c001d90056626ca23c56d42de97ad1a370ceeb2fe923e3b80a82bca4e22d351cf9ce6e55b64a7eb7d360d62c6f2d20b3fb60183843a2906f6e3e1dffc5500fc8458f029b3844d4594772218eb41f4328849d8e32410e41e635def2962a198f4260a9a7bd1f0e95ac305636c6e7a66344b5b53835232e2865836729068a3b6189c6f620fe1d5215a53e4269faf2763889e6f37c13322f325fc2f85040cc80beae42b621ecf1bb1726f922047fe056755b121bed873546035a788ca57726186a99d4aa9878b38a3d6001560b9e9e1c3426ece890a51ebd03dfd93ed831af3648bcf4a888"], 0x108) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000180)=@dstopts, 0x8) 17:39:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setpriority(0x0, 0x0, 0x100000001) [ 64.027624] binder: 2722:2724 Acquire 1 refcount change on invalid ref 1 ret -22 17:39:31 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x6000000, 0x100000001, 0x6000000, 0x1}, 0x1c) setsockopt$packet_int(r0, 0x107, 0x13, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 17:39:31 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$netlink(r0, 0x10e, 0x0, 0x0, &(0x7f00000001c0)) [ 64.190744] audit: type=1400 audit(1574876371.854:7): avc: denied { create } for pid=2743 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 17:39:31 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab35f4ad6", 0x4d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:32 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x6000000, 0x100000001, 0x6000000, 0x1}, 0x1c) syz_open_dev$binderN(0x0, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000000), 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = creat(&(0x7f0000000300)='./bus\x00', 0x0) dup2(r3, r0) inotify_init() 17:39:32 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$netlink(0x10, 0x3, 0xa) sendmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r6 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x8000fffffffe) 17:39:32 executing program 4: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) write$9p(r1, &(0x7f0000000340)="ff", 0x1) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17:39:32 executing program 0: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) write$9p(r1, &(0x7f0000000340)="ff", 0x1) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x20000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17:39:32 executing program 3: pipe(0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$tipc(0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="34000000c678450a4a1566f1d9554adc5baadfd4f5a527c4274bc5bcded9bb83826fcdc78c146dab3c4185f9a576da7f8e4bc8098baca833b4c770fc5e72562fffa8c3c1c6697ed0fa66370dc92a91742abf5e0d6f13f15a7134b4840e3cbbf33085516ff8c04cb570594bff04757b39564c9fbfcf83366e7161a5f402eaa65b8a4a384d8d8b6ddb50a9e6cfcdc2d265258c9a1ac4372e7477b695a7e03d", @ANYRES16, @ANYBLOB="000025bd7000ffdbdf2501000000000000000141000000180017000000010000c33000003a6e6c6d6f6e30000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe(0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 17:39:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a00)='./cgroup\x00\x8a@\xd2e\xb4W\xab\x99\xac\xb4\x9a\a\xea\x1c\xc5\xf9\xfd(2+mTS\xbc\xd0F\x88\x10\xd2\x11\xdc\x81q_\xc0Q\x1bE\x970Wv\xbeKN\tV\xb0\x01\x15\x18\x9c\x8b\xea\xe9 \x19\x0e\xfc8M\xb1 \x05\x82\xccW \x06\xe2\x06\xd5\xb3\aTbK\xd9\xa1DY\xbeZ5\x85\x04!\x90_\xfb\xa5\xfaX\xe8R\xe1\r\x1b\xa1\xb6\xd2)\x8bM\xe2\xb6\xac^\xe5\x84\xa9\x8fE{o\xb8\b\xb6\xd7P\xa3\x1a\x01\x8b{\x10J o\xeb\xb2|\x1d\xdb\xf2n@\x83\xeae\xbf\x9b\xcb\xbdj\x02\x8e\xa09\xbfo;\xce\x85\xea%\xe8\x84\xd8\xc6\xdfI\xe6\xa8\xf1\x00\x19kN\xce', 0x200002, 0x0) fstatfs(r2, &(0x7f0000000200)=""/121) [ 64.994430] audit: type=1400 audit(1574876372.664:8): avc: denied { create } for pid=2769 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 17:39:32 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957a", 0x49}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 65.037532] audit: type=1400 audit(1574876372.704:9): avc: denied { create } for pid=2771 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 17:39:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x58, 0x0, &(0x7f0000000380)=[@acquire_done={0x40106309, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 65.091090] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=30918 sclass=netlink_tcpdiag_socket [ 65.107615] audit: type=1400 audit(1574876372.774:10): avc: denied { write } for pid=2771 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 17:39:32 executing program 2: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) [ 65.170996] binder: 2796:2798 BC_ACQUIRE_DONE u0000000000000002 no match [ 65.190825] audit: type=1400 audit(1574876372.854:11): avc: denied { read } for pid=2771 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 17:39:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[], @ANYPTR=&(0x7f0000000200)=ANY=[]], 0x0, 0x0, 0x0}) [ 65.217932] binder: 2796:2798 got transaction to context manager from process owning it 17:39:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x58, 0x0, &(0x7f0000000380)=[@acquire_done={0x40106309, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 17:39:32 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) ftruncate(r4, 0x200004) [ 65.244669] binder: 2796:2798 transaction failed 29201/-22, size 0-0 line 3005 [ 65.259695] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.260819] binder: 2796:2804 BC_ACQUIRE_DONE u0000000000000002 no match [ 65.260829] binder: 2796:2804 got transaction to context manager from process owning it [ 65.260840] binder: 2796:2804 transaction failed 29201/-22, size 0-0 line 3005 [ 65.354400] binder: BINDER_SET_CONTEXT_MGR already set [ 65.363454] binder: 2813:2814 ioctl 40046207 0 returned -16 [ 65.370186] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.375875] binder: 2811:2815 got transaction with invalid data ptr [ 65.382357] binder: 2811:2815 transaction failed 29201/-14, size 104-24 line 3155 [ 65.411203] binder: 2813:2814 BC_ACQUIRE_DONE u0000000000000002 no match [ 65.422555] binder: 2813:2814 transaction failed 29189/-22, size 0-0 line 3014 [ 65.437352] binder: undelivered TRANSACTION_ERROR: 29189 [ 65.442880] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.454639] binder: BINDER_SET_CONTEXT_MGR already set [ 65.482211] binder: 2811:2819 ioctl 40046207 0 returned -16 [ 65.495778] binder: 2811:2821 transaction failed 29189/-22, size 104-24 line 3014 [ 65.505024] binder: undelivered TRANSACTION_ERROR: 29189 17:39:33 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x185000, 0x0) 17:39:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fchown(r2, 0x0, 0x0) 17:39:33 executing program 5: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001380)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae6", 0x2b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 17:39:33 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000000300)='2'}) 17:39:33 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 17:39:33 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='\x00\xaeC\xae\xc4\x05\xa9\xbd~\xfb\xd3\x81\xff\x9c\xf1\xcc\xfe:4\x01\x01\x01\x00w\xa7\x04~\\\xd4Y\x04\xaf^\xc6\xf2\x98\"\xa0\xa1\x04\xaf\x81\x00ov0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) 17:39:35 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:35 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='\x00\xaeC\xae\xc4\x05\xa9\xbd~\xfb\xd3\x81\xff\x9c\xf1\xcc\xfe:4\x01\x01\x01\x00w\xa7\x04~\\\xd4Y\x04\xaf^\xc6\xf2\x98\"\xa0\xa1\x04\xaf\x81\x00ov0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) 17:39:35 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 68.238535] binder: 2874:2884 got transaction with invalid offset (0, min 0 max 0) or object. [ 68.270478] binder: 2874:2884 transaction failed 29201/-22, size 0-24 line 3199 [ 68.279249] binder: undelivered TRANSACTION_ERROR: 29201 17:39:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 68.294168] binder: 2874:2894 got transaction with invalid offset (0, min 0 max 0) or object. [ 68.303106] binder: 2874:2894 transaction failed 29201/-22, size 0-24 line 3199 [ 68.317656] binder: 2895:2898 got transaction to invalid handle [ 68.324176] binder: undelivered TRANSACTION_ERROR: 29201 17:39:36 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479", 0x34}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 68.348029] binder: 2895:2898 transaction failed 29201/-22, size 0-0 line 3014 [ 68.372476] binder: undelivered TRANSACTION_ERROR: 29201 17:39:36 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@dev, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@loopback, 0x0, 0x6c}, 0x0, @in6=@mcast1}}, 0xe8) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@empty, @in6=@rand_addr="06060c16645ad7c394056f45dea8c851", 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@rand_addr="09de0b543dab41918e64211f6500", 0x0, 0x6c}, 0x0, @in6=@mcast1}}, 0xe8) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@empty, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@loopback, 0x0, 0x32}, 0x0, @in6=@mcast1}}, 0xe8) r5 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c80)=ANY=[@ANYBLOB="02120000020000000a000097d3d3a6c4191e8ed4ef0fbf6e0d1bc1b5889a4d1864e585963d804c861bb1032de7bd494d87bc89b8c9a2d1fd6272c1fb7fff1308691767afe97a06c1cd3aa16cdde5c98cb0bd1c79cef8e0be74ac3629b6f51708acfa90d2750dca1e2cfd86b6423549e608b4f56ea9d88cf52e9d5284f9ad4f11a843a5c8b1c4a55ce60e107fda4135dbe338482e43a1801eac1e4ae67540c90b9966142a5df28d476582dc1c56e4e76327bdbb4f37045a6a28d964126a34876f462dae60eb8a60f63a94a1b4bc6e7720c54b30ba548c13512326a37d7b5069c703bbaf8be89457718446a472de4552ac8bfcb2553852354f3e1bde4af9e718410000189ef5263e01b333f045652d5da2d9fd685aaf7c5b11f0c773252d3e3d98cf479cadf8031dafe559d65af9aad2a4ee0fca6bbf6991b33f0c23faaa6c77ea8d3905160b43e959d24e27a7a40e3b75bf6ce6dcfd7b7d6e02b331ec6b90cd8ad14f9c1cbe8e22668e1eb51b9381beaf73dd1382f2cfd7e78524014f0c1e7c40ee1e4d750916a365fefdb1f033582a32537385eab302d4e1b3fc18190c784f0dd0a2bc20409374e56678304accacda1dadca92fffd35bec0f84fef9488de57c712b21d2aacb00306b6022034e6b741d5add496330f47ad560f53b4000000000072432c1dce6b9b7c65a1d9f507aafa32ff43728385c149da55bc4eef9ab582f7634122120b6e813385703ecce7870f9910d086f4d12227c586091e67548b29e0a66fbcd252be54988273473e1017b2612c882650201132b056369db39e1d7ae69980"], 0x10}}, 0x0) recvmmsg(r5, &(0x7f0000000f00), 0x5, 0x0, &(0x7f0000001000)={0x77359400}) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="020b0001020000000000400000b04800116ec41899f3ffaca7f841ce64a0ffffffffffffe5f3128a10cd9ad416b8ba612973d9155721e6a9c95c13b6bdf8c48c2079182105bbab23b672c8b4fc32ecb2c6830a5dd89533958eff0f00000b59912f040b08aa9e10f97c1f43ede7cbdd999bc26fc477bc793266de860647e0350717ee4c5228b067279034a5bbd0440ee51303f6be7b67b59dbc18c386fddddf6904b2c3d9534416be963f95f65b5fd8eae4d2ff09791f391482e6d532709840dfeb0100e0eae6ebbaebded4d018efefeeecaaef10ba16ebeb733320621cce7fca41f938caef3b3868bbd9"], 0x10}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="020b0001020000000000400000b04800116ec41899f3ffaca7f841ce64a0ffffffffffffe5f3128a10cd9ad416b8ba612973d9155721e6a9c95c13b6bdf8c48c2079182105bbab23b672c8b4fc32ecb2c6830a5dd89533958eff0f00000b59912f040b08aa9e10f97c1f43ede7cbdd999bc26fc477bc793266de860647e0350717ee4c5228b067279034a5bbd0440ee51303f6be7b67b59dbc18c386fddddf6904b2c3d9534416be963f95f65b5fd8eae4d2ff09791f391482e6d532709840dfeb0100e0eae6ebbaebded4d018efefeeecaaef10ba16ebeb733320621cce7fca41f938caef3b3868bbd9"], 0x10}}, 0x0) [ 68.448007] binder: 2912:2914 got transaction with invalid offset (0, min 0 max 0) or object. [ 68.457258] binder: 2912:2914 transaction failed 29201/-22, size 0-24 line 3199 17:39:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 68.488389] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.566675] binder: 2921:2923 got transaction with invalid offset (0, min 0 max 0) or object. [ 68.581837] binder: 2921:2923 transaction failed 29201/-22, size 0-24 line 3199 [ 68.605323] binder: undelivered TRANSACTION_ERROR: 29201 17:39:37 executing program 2: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) 17:39:37 executing program 0: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="34000000c678450a4a1566f1d9554adc5baadfd4f5a527c4274bc5bcded9bb83826fcdc78c146dab3c4185f9a576da7f8e4bc8098baca833b4c770fc5e72562fffa8c3c1c6697ed0fa66370dc92a91742abf5e0d6f13f15a7134b4840e3cbbf33085516ff8c04cb570594bff04757b39564c9fbfcf83366e7161a5f402eaa65b8a4a384d8d8b6ddb50a9e6cfcdc2d265258c9a1ac4372e7477b695a7e03d", @ANYRES16, @ANYBLOB="000025bd7000ffdbdf2501000000000000000141000000180017000000010000c33000003a6e6c6d6f6e30000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) 17:39:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:37 executing program 1: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) 17:39:37 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(r0) [ 69.489697] binder: 2935:2940 got transaction with invalid offset (0, min 0 max 0) or object. [ 69.499337] binder: 2935:2940 transaction failed 29201/-22, size 0-24 line 3199 [ 69.500369] audit: type=1400 audit(1574876377.164:12): avc: denied { write } for pid=2934 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 17:39:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 69.548718] binder: undelivered TRANSACTION_ERROR: 29201 17:39:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) 17:39:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed1", 0x13}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) keyctl$instantiate_iov(0x14, 0x0, 0x0, 0x0, 0x0) 17:39:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(r0) 17:39:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 1: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) 17:39:39 executing program 2: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, &(0x7f0000000240)) pipe(0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x40000000, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) r4 = socket(0x0, 0x802, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) io_submit(0x0, 0x1, &(0x7f0000000180)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8001, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x1, r3}]) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ptrace(0x10, r1) wait4(0x0, 0x0, 0x2, 0x0) 17:39:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 3: clone(0x774cbdcf9e14b664, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 71.452771] binder: 2975:2980 transaction failed 29189/-22, size 0-24 line 3014 [ 71.465287] binder: undelivered TRANSACTION_ERROR: 29189 17:39:39 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f", 0x14}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 71.536255] binder: 2989:2995 transaction failed 29189/-22, size 0-24 line 3014 17:39:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(r0) 17:39:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 71.581715] binder: undelivered TRANSACTION_ERROR: 29189 17:39:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 3: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, 0x0) [ 71.639555] binder: 3015:3016 transaction failed 29189/-22, size 0-24 line 3014 [ 71.653363] binder: undelivered TRANSACTION_ERROR: 29189 [ 71.666859] binder_alloc: 3012: binder_alloc_buf size 2097152 failed, no address space 17:39:39 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)}, 0x0) bind$netlink(r0, &(0x7f0000000040), 0xc) 17:39:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(r0) [ 71.692341] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 71.713091] binder: 3012:3017 transaction failed 29201/-28, size 2097152-0 line 3137 [ 71.718157] binder_alloc: 3024: binder_alloc_buf, no vma [ 71.718198] binder: 3024:3026 transaction failed 29189/-3, size 0-24 line 3137 [ 71.734554] binder: undelivered TRANSACTION_ERROR: 29189 [ 71.748928] binder: undelivered TRANSACTION_ERROR: 29201 17:39:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x1, 0x0, 0xc}, 0x20) 17:39:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:39 executing program 0: fdatasync(0xffffffffffffffff) 17:39:39 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() socket(0x0, 0x0, 0x0) ptrace(0x10, r0) wait4(0x0, 0x0, 0x0, 0x0) 17:39:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet(r2, &(0x7f0000002a00)=[{{&(0x7f0000000300)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="580000000000000000000000070000000707217f00000100862c000000ff000f1ad3a5ba76b4f1ffaa07e1918e0709c9057ce4c8ec7c070ead4fa5cdfc87cacea4cfa4cc44140951e000000200000002000003840000000517bbe8cb267ed65fbd8e6591b4a87422c0d33da4f757fee5b7c1368218ca90d49bf6334524a7ca6265847dde05e5eb98263358095cbd611ec1c1be3176b98f0b7487763d594841b9901c5ed7be7dcb7931cc0dfea0be4b877e680382f60809f55d91bb41b272b3892a8be20b8c226247bbfe018ef08ac6bc765ac82a0e3c59dcdea49237346e3bbcab23d26059947a0d32b0d3071d6d528ad1493e"], 0x58}}], 0x1, 0x0) 17:39:39 executing program 0: fdatasync(0xffffffffffffffff) [ 71.976931] binder_alloc: 3044: binder_alloc_buf size 2097152 failed, no address space [ 71.980009] binder_alloc: 3041: binder_alloc_buf, no vma [ 71.980049] binder: 3041:3049 transaction failed 29189/-3, size 0-24 line 3137 [ 71.980340] binder: undelivered TRANSACTION_ERROR: 29189 [ 72.017103] binder_alloc: 3042: binder_alloc_buf size 2097152 failed, no address space 17:39:39 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet(r2, &(0x7f0000002a00)=[{{&(0x7f0000000300)={0x2, 0x4e23, @empty}, 0x10, 0x0, 0x0, &(0x7f0000001380)=[@ip_tos_int={{0x14}}], 0x18}}], 0x1, 0x0) 17:39:39 executing program 2: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f00000000c0)='./file0\x00') mkdirat(r0, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) fchmodat(r1, &(0x7f0000000000)='./file0\x00', 0x0) [ 72.045259] binder_alloc: 3060: binder_alloc_buf, no vma [ 72.058588] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.074241] binder: 3042:3047 transaction failed 29201/-28, size 2097152-0 line 3137 17:39:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:39 executing program 3: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x20000) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000200)={0x0, r4, 0x0, 0x2000000000, 0x1, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) [ 72.093878] binder: 3060:3062 transaction failed 29189/-3, size 0-24 line 3137 [ 72.099040] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.099087] binder: 3044:3046 transaction failed 29201/-28, size 2097152-0 line 3137 [ 72.119485] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.132514] binder: undelivered TRANSACTION_ERROR: 29201 17:39:39 executing program 2: keyctl$set_reqkey_keyring(0xe, 0xa) 17:39:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="852a7470"], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000000a2"]], 0x0, 0x0, 0x0}) 17:39:39 executing program 5: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 72.183500] binder_alloc: 3076: binder_alloc_buf size 2097152 failed, no address space [ 72.218369] binder: undelivered TRANSACTION_ERROR: 29189 17:39:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x58, 0x0, &(0x7f0000000380)=[@acquire_done, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000007c0)}) [ 72.242373] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.264662] binder: 3084:3087 got transaction with invalid data ptr [ 72.271327] binder: 3076:3077 transaction failed 29201/-28, size 2097152-0 line 3137 17:39:39 executing program 5: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 72.293171] binder: 3084:3087 transaction failed 29201/-14, size 104-24 line 3155 [ 72.301880] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.322570] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.332884] binder: BINDER_SET_CONTEXT_MGR already set [ 72.350880] binder: 3084:3091 ioctl 40046207 0 returned -16 [ 72.368024] binder: 3093:3095 BC_ACQUIRE_DONE node 53 has no pending acquire request [ 72.379495] binder: 3093:3095 got transaction to context manager from process owning it [ 72.390151] binder_alloc: 3096: binder_alloc_buf size 2097152 failed, no address space 17:39:40 executing program 5: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 72.399425] binder: 3093:3095 transaction failed 29201/-22, size 0-0 line 3005 [ 72.401056] binder: 3084:3099 transaction failed 29189/-22, size 104-24 line 3014 [ 72.419861] binder: undelivered TRANSACTION_ERROR: 29189 [ 72.439027] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.462152] binder: 3096:3100 transaction failed 29201/-28, size 2097152-0 line 3137 [ 72.483764] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.493149] binder: 3093:3107 BC_ACQUIRE_DONE node 58 has no pending acquire request [ 72.495155] binder: undelivered TRANSACTION_ERROR: 29201 17:39:40 executing program 0: fdatasync(0xffffffffffffffff) 17:39:40 executing program 1: pipe(0x0) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) pipe(0x0) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="34000000c678450a4a1566f1d9554adc5baadfd4f5a527c4274bc5bcded9bb83826fcdc78c146dab3c4185f9a576da7f8e4bc8098baca833b4c770fc5e72562fffa8c3c1c6697ed0fa66370dc92a91742abf5e0d6f13f15a7134b4840e3cbbf33085516ff8c04cb570594bff04757b39564c9fbfcf83366e7161a5f402eaa65b8a4a384d8d8b6ddb50a9e6cfcdc2d265258c9a1ac4372e7477b695a7e03d", @ANYRES16, @ANYBLOB="000025bd7000ffdbdf2501000000000000000141000000180017000000010000c33000003a6e6c6d6f6e30000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) gettid() wait4(0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 17:39:40 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) fcntl$dupfd(r2, 0x0, r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:40 executing program 3: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) ftruncate(r1, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x103042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x20000) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000200)={0x0, r4, 0x0, 0x2000000000, 0x1, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17:39:40 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) ftruncate(r3, 0x200004) sendfile(r2, r3, 0x0, 0x8000fffffffe) r4 = socket$netlink(0x10, 0x3, 0xa) r5 = open(&(0x7f0000000580)='./bus\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x8000fffffffe) timer_settime(0x0, 0x0, 0x0, 0x0) [ 72.532031] binder: 3093:3107 got transaction to context manager from process owning it [ 72.541888] binder: 3093:3107 transaction failed 29201/-22, size 0-0 line 3005 [ 72.551354] binder: undelivered TRANSACTION_ERROR: 29201 17:39:40 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 72.627671] binder_alloc: 3112: binder_alloc_buf size 2097152 failed, no address space [ 72.645225] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=30918 sclass=netlink_tcpdiag_socket [ 72.660383] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 17:39:40 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 72.682003] binder: 3112:3119 transaction failed 29201/-28, size 2097152-0 line 3137 [ 72.715889] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=30918 sclass=netlink_tcpdiag_socket [ 72.721492] binder: undelivered TRANSACTION_ERROR: 29201 17:39:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f0000000180)=ANY=[]], 0x0, 0x0, 0x0}) [ 72.807450] binder_alloc: 3136: binder_alloc_buf size 2097152 failed, no address space [ 72.826742] binder_alloc: 3142: binder_alloc_buf, no vma [ 72.836284] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.845366] binder: 3142:3143 transaction failed 29189/-3, size 0-24 line 3137 17:39:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 72.853570] binder_alloc: 3144: binder_alloc_buf size 2097160 failed, no address space [ 72.866842] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 72.875992] binder: 3136:3139 transaction failed 29201/-28, size 2097152-0 line 3137 [ 72.887724] binder: undelivered TRANSACTION_ERROR: 29189 [ 72.909626] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.922009] binder: 3144:3145 transaction failed 29201/-28, size 2097153-0 line 3137 [ 72.970376] binder: undelivered TRANSACTION_ERROR: 29201 [ 72.980988] binder_alloc: 3144: binder_alloc_buf size 2097160 failed, no address space [ 72.993026] binder_alloc: 3149: binder_alloc_buf, no vma [ 73.009161] binder: 3149:3152 transaction failed 29189/-3, size 0-24 line 3137 17:39:40 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) fdatasync(r0) 17:39:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:40 executing program 3: clone(0x2000802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1e) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x1f}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) [ 73.031203] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 73.051281] binder: undelivered TRANSACTION_ERROR: 29189 [ 73.068332] binder: 3144:3151 transaction failed 29201/-28, size 2097153-0 line 3137 17:39:40 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sysinfo(&(0x7f0000000000)=""/14) [ 73.099835] binder_alloc: 3154: binder_alloc_buf size 2097152 failed, no address space [ 73.115082] binder: undelivered TRANSACTION_ERROR: 29201 [ 73.127268] binder_alloc: 3161: binder_alloc_buf, no vma [ 73.134433] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 73.161039] binder: 3154:3159 transaction failed 29201/-28, size 2097152-0 line 3137 [ 73.163739] binder: 3161:3162 transaction failed 29189/-3, size 0-24 line 3137 [ 73.176677] binder: undelivered TRANSACTION_ERROR: 29189 [ 73.228678] binder: undelivered TRANSACTION_ERROR: 29201 17:39:40 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$netlink(0x10, 0x3, 0xa) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) ftruncate(r3, 0x200004) sendfile(r2, r3, 0x0, 0x8000fffffffe) r4 = socket$netlink(0x10, 0x3, 0xa) r5 = open(&(0x7f0000000580)='./bus\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x8000fffffffe) timer_settime(0x0, 0x0, 0x0, 0x0) 17:39:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@empty}, 0x20) 17:39:40 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fcntl$lock(r0, 0x5, &(0x7f0000000000)={0x0, 0x0, 0xffffffffffff8db6}) 17:39:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:41 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) ioctl$FIBMAP(r0, 0x1, 0x0) 17:39:41 executing program 1: rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0xffffffffffffffff) [ 73.387960] binder: 3175:3183 transaction failed 29189/-22, size 0-24 line 3014 [ 73.413400] binder: undelivered TRANSACTION_ERROR: 29189 17:39:41 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) fdatasync(r0) 17:39:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$inet(r0, &(0x7f000001b4c0)={0x0, 0x0, &(0x7f000001b340)=[{&(0x7f0000019080)="7a736ad44a5b81b307ce5af873f78cde", 0x10}], 0x1, &(0x7f000001b440)=[@ip_ttl={{0x14}}], 0x18}, 0x0) 17:39:41 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x40010, r0, 0x0) [ 73.528133] binder: 3200:3203 transaction failed 29189/-22, size 0-24 line 3014 [ 73.563114] binder: undelivered TRANSACTION_ERROR: 29189 17:39:41 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x1}, 0x20) 17:39:41 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f00000013c0)={0x0}) rt_sigtimedwait(&(0x7f0000001300), 0x0, &(0x7f0000001400)={r2}, 0x8) 17:39:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:41 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000200)='/dev/keychord\x00', 0x2, 0x0) write$P9_RVERSION(r2, &(0x7f0000000240)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15) 17:39:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:41 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) fdatasync(r0) 17:39:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000068000000000000001800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[], @ANYPTR=&(0x7f0000000200)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:41 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001380)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d0100", 0x27}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) [ 73.852857] keychord: Insufficient bytes present for keycount 15 [ 73.861293] keychord: Insufficient bytes present for keycount 15 [ 73.872239] binder: 3223:3224 transaction failed 29189/-22, size 0-24 line 3014 [ 73.892930] binder: undelivered TRANSACTION_ERROR: 29189 17:39:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 73.954796] binder: 3231:3235 transaction failed 29189/-22, size 2097152-0 line 3014 [ 73.978650] binder: undelivered TRANSACTION_ERROR: 29189 [ 73.987998] binder: 3233:3236 got transaction with invalid data ptr 17:39:41 executing program 0: syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(0xffffffffffffffff) [ 74.003136] binder: 3233:3236 transaction failed 29201/-14, size 104-24 line 3155 [ 74.025479] binder: 3244:3246 transaction failed 29189/-22, size 2097152-0 line 3014 [ 74.033463] binder: undelivered TRANSACTION_ERROR: 29201 [ 74.034302] binder: BINDER_SET_CONTEXT_MGR already set [ 74.034311] binder: 3233:3249 ioctl 40046207 0 returned -16 [ 74.060971] binder: undelivered TRANSACTION_ERROR: 29189 17:39:42 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x6000000, 0x100000001, 0x6000000, 0x1}, 0x1c) write$P9_RSYMLINK(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000000), 0x4) r1 = creat(&(0x7f0000000300)='./bus\x00', 0x0) dup2(r1, r0) 17:39:42 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f364602344324", 0x33}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:42 executing program 0: syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(0xffffffffffffffff) 17:39:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:39:42 executing program 0: syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) fdatasync(0xffffffffffffffff) [ 74.727325] binder: 3263:3265 transaction failed 29189/-22, size 2097152-0 line 3014 17:39:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 74.774010] binder: undelivered TRANSACTION_ERROR: 29189 [ 74.816928] binder: 3275:3281 ioctl c0306201 0 returned -14 [ 74.847420] binder_alloc: 3283: binder_alloc_buf, no vma [ 74.879426] binder: 3283:3284 transaction failed 29189/-3, size 2097152-0 line 3137 [ 74.899942] binder: undelivered TRANSACTION_ERROR: 29189 17:39:44 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r2, 0x8947, &(0x7f0000000080)={'ip_vti0\x00', @ifru_map}) 17:39:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x34, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000012010b7e8b93cdb6ba05d6b8ad57a22cf2"], 0x0, 0x0, 0x0}) 17:39:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:39:44 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setpriority(0x2, 0x0, 0x100000001) 17:39:44 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x6000000, 0x100000001, 0x6000000, 0x1}, 0x1c) write$P9_RSYMLINK(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000000), 0x4) r1 = creat(&(0x7f0000000300)='./bus\x00', 0x0) dup2(r1, r0) 17:39:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x34, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000012010b7e8b93cdb6ba05d6b8ad57a22cf2"], 0x0, 0x0, 0x0}) [ 76.984155] binder_alloc: 3300: binder_alloc_buf, no vma [ 76.984359] binder: 3299:3306 transaction failed 29201/-22, size -4992577103309436159--996242920095295995 line 3137 [ 76.984490] binder: undelivered TRANSACTION_ERROR: 29201 [ 76.993617] binder: 3299:3307 transaction failed 29201/-22, size -4992577103309436159--996242920095295995 line 3137 [ 76.994223] binder: undelivered TRANSACTION_ERROR: 29201 [ 77.025764] binder: 3298:3305 ioctl c0306201 0 returned -14 17:39:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:39:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x19, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="116348400000000000e400000000000000000000fbd03ad097"], 0x0, 0x0, 0x0}) 17:39:44 executing program 2: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x0, 0x0, 0x102, 0x1, 0x0, 0x0, 0x1}, 0x20) [ 77.036869] binder: 3311:3313 transaction failed 29201/-22, size -4992577103309436159--996242920095295995 line 3137 [ 77.065778] binder: undelivered TRANSACTION_ERROR: 29201 17:39:44 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001380)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d8680027", 0x21}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 17:39:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:39:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000f40ff8)=[{0x6}]}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) dup2(r3, r2) 17:39:44 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 77.108624] binder: 3319:3321 ioctl c0306201 0 returned -14 [ 77.119628] binder: 3300:3304 transaction failed 29189/-3, size 2097152-0 line 3137 [ 77.133517] binder: undelivered TRANSACTION_COMPLETE [ 77.141414] binder: undelivered transaction 104, process died. 17:39:44 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pread64(r0, 0x0, 0x0, 0x0) [ 77.182236] binder: undelivered TRANSACTION_COMPLETE 17:39:44 executing program 2: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 17:39:44 executing program 3: r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r1, &(0x7f0000001400)=[{&(0x7f00000010c0)=""/247, 0xf7}], 0x1) ppoll(&(0x7f0000001080)=[{r2}], 0x1, 0x0, 0x0, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000140)=0x6) fcntl$setsig(r1, 0xa, 0x12) dup2(r1, r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x10005812}) io_setup(0x20000000002, &(0x7f0000000240)=0x0) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, r4, &(0x7f0000000180)='\f', 0x1}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) dup3(r3, r4, 0x0) fcntl$setown(r1, 0x8, r0) r6 = creat(&(0x7f0000000080)='./bus\x00', 0x0) r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) dup2(r7, r6) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0}]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = creat(&(0x7f0000000040)='./bus\x00', 0x0) write$binfmt_elf64(r10, &(0x7f0000000340)=ANY=[@ANYBLOB='v'], 0x1) tkill(r0, 0x15) [ 77.223544] binder: undelivered transaction 106, process died. [ 77.260558] binder: undelivered TRANSACTION_ERROR: 29189 [ 77.267631] binder: BINDER_SET_CONTEXT_MGR already set [ 77.304609] binder: 3339:3343 ioctl 40046207 0 returned -16 17:39:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x1, 0xfe18) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) 17:39:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:39:45 executing program 4: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:45 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f3646", 0x2f}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:39:45 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001380)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae6", 0x2b}], 0x4, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r2, 0x0, 0x0) 17:39:45 executing program 4: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:39:45 executing program 1: clone(0x8080000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 17:39:45 executing program 4: mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:45 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 17:39:45 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="580000001400add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000040ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 17:39:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 17:39:45 executing program 0: add_key(&(0x7f0000000400)='ceph\x00', 0x0, &(0x7f0000000480)="1c", 0x1, 0xfffffffffffffffd) 17:39:45 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$inet6(r0, &(0x7f0000003640)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) 17:39:45 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:48 executing program 2: r0 = socket$inet(0x2, 0x3, 0x0) recvmsg(r0, &(0x7f0000001440)={0x0, 0x0, 0x0}, 0x1) 17:39:48 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 17:39:48 executing program 1: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xe) 17:39:48 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_tcp_int(r1, 0x6, 0x13, 0x0, &(0x7f0000000040)) 17:39:48 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) splice(r1, 0x0, r0, 0x0, 0x420000a77, 0x0) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[], 0xfffffd88) 17:39:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:48 executing program 1: open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r0 = socket(0x2, 0x3, 0x0) connect$unix(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="82022e2f66696c6530001835a41d8c30df8d8373fb648b6d89851d31a4c96d9114902dad2652642ad710c03be48e61665b0900000066860828df8421d3430031cb19209eadbe536eb67c8a26ead8ad3a69ac5a42011edafc4cf5dca73c577829bab111bb7c857b9b8fe0f2031559074c16ef9e06f5271bce5ed8772a4e4bbabb76f279653733033b45bd632937a526e65300b700000000f100000d1b95a967c90fac571199169d196bbdb0c715c0fe2abbca36c4d179a3eb19996408215cb31bf68ac6fdb12503f30810567414ba464ba35d039ee4262c71805d12cb2819bd8723e26f4b6bd9671fa22f8fb099e3a00cfbc83284c769bde1c8a2dd6828b7fef63ba4f7d952e3daaf6b60c28ea5cfda139fb2218d607fea1020396caf61220eb6be16dad9605b29e0fbdc931565aee019f9b4d0a47000000000000000000000000000000000310975cc4925162721632a4971462f6249d79ef868f61d147f651a834f4e54"], 0x10) writev(r0, &(0x7f0000000640)=[{&(0x7f0000000200)="2828f975077018c2ff0195bb5dbfb0e416790bb19845fef6ab12b275fdfce5b8483164b80da65e1b056d09f082078d7889b1fa9f33236f495b6fa4a892f519a17e6c7223e4eae1fad17bcaafedba239949f127ca4e0da5804b5041650aaefd59295d965919c5cc8064c50ba47e6903cd8b55f34c5a138fb4914ebd8955e2229721ff9d8b970082921fe1c44b7fce8799c3a42cccd0f128b816467387a52701083ef97b1c2690d40799a677caa7151437120b169ca038fad76892843ff54fd44504005e86", 0xc4}, {&(0x7f00000011c0)="3c79e21fba9ba94883209b0095f7cc5268acaf1b827faea109245afb2da17de1a0eec777d7f1a25f915aa490dfbb91b91ae13267b42ad6a2cdc350a03623a7fdc3a33c486fbb6a6a10214aa4b4c864914f09c339d363683f42bc88a68bb0d3b21402365847f4587e36d99ec32f022e83d78a93d7ef3f9c1d38e3064b4cac12b5e7f9a0f68d7791244b38d13fa0a56e9b0b577c1aeaac7a9805bbcf7774ba5cc79235c7ac15922a0998c9cbe7413a0c5b4d24282643ca1f2394bd3259b20132c46d17db5c77a749ce8574bbf50a84f02e676571d866f22de1c4e30d08751106cc1cc1cdd98608ac268de8fb778ecf8802ce82c5f41fc8d033329d0e5eb56440f9e2a7a25618ad3352f635e3fd166c4809216de214f722e51efd02038489a03137b48f6f682f45c96a000fd696c76fbb525d0ede93c349f013f4a67933a3f2bc3ae5f95cba82f4afa5e011f3484bae242e41b37927151a4b8a052b9b85cecddcc6867727a0f9093d13241577bca189bd0cfc931f5b0ae632abe65032d2af3eb2c0adb5b111564ff16caf03f5a64fb7516f06b9a86c683ec0554c7432464610bd319a0ded3878aa5d5faf7fc6810fb9b85273a4e83daa1178e351c92e84f4e8992760ba2d18a94a5897ad45b8d18dd5717b1fdcbc83ef6dc0ea4df2e7dfd9f465ebffe22f21c62115c72ab50ad75683b687186c0333e335050650ea7f5490539b0966948e697389cb9dbf87905bb9c9f3f58b30642cabfbcfca74f6d36e9517eeda2902322e93c5a97fe2a12fd0547bc8ea4dfa03f70d5647d2a8fa8bf3bc5744c2ec0385a93bd85e2726ffbc15d4dbec94a2777e9bafd2c9f4aae0707a56827c61a823d333c3be62cfaba02b307c9a1f44723693aa20a8ab47387f11a55e1e6a5dfbc30bf64cad46c4068be1128d40f8cda2e01d663b2cf2bf2fffa42bcaf6b5151242021828d3a9d0779619e60faba20d3b5e46c09be1eaa01b37265231e26ccd55a9fc30320290afbdef8d5e86236b70b1f3921d584567907ab491057e9f8b5875bfd34afb81910b231f318884488f71427cfd1acd41b91b83fa2d7e92b34b48bcdf1918c50e3e9ed01cd2c18f9caee92e8ebad13492ac5f5bf1e1435deb8e610d668cdcd4f4ca553f2febddf2854555409adb9820c1a66e62f0aaa5e15b48e4ab1bd389ffba7dd4bba37119c2455a1345b2f8a5710b0c90c5355e727914d5ce3b45ce9649e224bf2a8ddd86e69f8c9dce8b38ca55a8dd5fd2ae24b5d0aed2d4d4e29ec2f0ea12ab570f15d8151a71c76cd957cf403cc13a6a7fbe85044a7bddc7fe9aa05aead2d2d02347efd9ee25f6c98b6a1732745daefc121ce7b3eb71298563ff40cad9f50eb593f4c7dbefef68607405071665ae76fff0c23d9d39e319266305e86c4ab217946f5be0bcd00e91111e2c3b88bbd7dd8055667899417a2a7e30b475c42ba0699b4a7b3c384b05bfeca51dc32a3df29067ffa0c7a928c40fa35ba7631c8c295aa513c36e18ce66ad3dcaea7c4a94df1747270ec5d2587144386fbba1b93689d1236dc8012998e26051af4eb6be04c1cebf3af8016c5e4fc1a7d41c6b2e3da8cb185690173c6d0a60ffa072799119ad98b6fefc729dd579b5a001b9cb90ff27c001027f7930989820ced7d9ac1937bcbba6e202d13059dd5ecbf28292a79f64e73a27959261f0de1d55459a4a7223df7cb2409d9e725650ce1a9cbf2dd69443084f27429981d330e45f180d1fe975202d8dc63852e6464deb2b6c6b51b45c29b501e1024f7d950686f943c940145f09e216399b25d771e521d41436550f328c4f74993c75243b4fb689c5f05056afcbbca0c19cad1ea4185b69e9d54fc6baecaf80f55e26ea159876033579ffa9841da40e3718410da326db6d1114e5fddba0023779af920e62c9b4c1358a89e273520ccc51eb5ab474e09e406ac814c5fda291ea91fb879e1b487d5062a550fddb9d04bcfa99ed02cace18c78c7d466e5b6fedc8a1dbeef8e32bb9507b99d98c366d8ab0aca760d4787d443ba161d967960b775f17fbc5178a6d2211c398f49db330291c98990ea736bf1a6323dbe42c97e30a0a8fc7843dfef41f59526715d6b4f416b773dc134753a704c6fedbfe09fc21783ca39f4e6d580db9c4833bac8e76979434c066069af973cd8494e3232be631d9055e287514fd68aeac3e2c68c96ce188619080ef609564d4198805bb294bbe81509489779d0e0d79cf6ef1ebb47531eca04232fb5fce2ebed9081de6495c9bb2146917d5111c3538f99a4d9da0d5b920589df248d4898d48e475aa4fb583dded56488d24a5ba33cd445d2df252b78e0a918a59a5b0632bebd9f7c6c2dd273643177f68b1bb69770ce2b108c7da4e73b714d667ae476a2763290c1d530f150891f778add0f8b7d9cef38a5820dd2864cbb257196824664c14f62d2fc731467f487fadafd57cb297bebad59d6dfdda2f990806026559b7b49520121df714fd75f61836ed0dace07376dca0aaf435c6b7c75a3f75cfa74ab7d8ac4715e24bf35dd1bbc952c7f77817c8131fde56470a63e41aa3fc9bcc64cb824b6b6c03fd0d7530afa42a02c3917ac3ec27a7ef304a794c4889e76fbdeaf939e53bc0a548de2a33cea292b09066542802a3493245523eb1ebb08fef47f63d094c30ef5ccf2c242dba94121684243f160dd5c601fe81407eaff2f6abc9bd159db619adf4ac3f670e00efb143ba49d92e2152f77046fbcc457a30c07655e245e51df79606a27b50aa31c4697610111ee899b395ffc76121d5e2e3d36145d9551a39bc9e1d1d80ba4e5caedfb8836ce49c779c7e2da3ce4a3b42189bb29f4aca5e4b381b0bc86dc7f83be4f5fb4885710411baebaa2e828826a3c097c2862924af173d79118a413d17df56058c5a146dc89c443cb3967b1c7a6954d8fafeb7927aecef030bed2a146d74e2273a9ac18424d4b28142b8f2232da48cb771566b9641c1c725b1eb52c2b6efe8d754c8cba3bebc20e74f1ce0725ef334a92ca90434d9bce6c77419772c430f1425a3edafa5ea477899b8c9b0b486be3a8473ace8f8589e1390ef4dbc039012386a93bad636e50ba7056169de2c075032ea1112e807b3373e3841cce1ade0ae9205d2938a1a3f7f6a9436dc5c9ca847230d3eff9d59025e43024b83a44f781d6f07781b79a69a7867aef1d5ab8b4bd9b5538f1cae58bd943d5f5c55d91162baabca571b1757ad0f53fff6593b24dccea3933c656fe89a102e0dfbbf36147f9f509190795ff8183a6f5d573aee0cf06ef9be29f3a72964f5cb0c6df916c49c28192a54ac95764d4f895c01e51dc31d73764781f14e56a437f2aa96402de93c64919a6452cae172e26cbb5a77a21a1df664b87f9e7fa45006d20333427ab12d2846fca0a4c0cc48f99b3c0e7e7c5b47e70caff208b932f156b37b96c53fe1642ae93c470526ace47f4602c139c7094b19faa8287db3101c20cb4d4e409311faa9e3e37b7766110a5680717e930a9298913e814cc9d193666f6ec763630089563d5a3991623eb467d8244501ccc323fe6a131bd03630165db3255b5b303cb98b3a8af90dd8f5dd79108caea557211e8b927b211f3960fc75a4a55aa271aae555a13719a34d8358814ea62ed55de10cf76272b2d769cf7a32d4d98d7bd8f43d699e4eb24196d844a10074f9af3b445107b5c3cbc99f77f3c1866b95246fad15fe0168728f066253675e229cd818c8538cfcfc54208e7679f9b05b7e469bb4bafa73fbf113940b47409442859aaf5ff41a820140fa58373ab937fca62a3893e9cf290e4649b38dde07a4d7f63389e96c85f1e25a93b39b676eaca5f7ee13fc7df833f04f70f32171cd3c081b6a2eb2f2042f530f8c7fac40cdf11df48af5c04ea2acb7e26ffc6ebbdbdf0827901417864891c1cde57a5a97537a681492becf533537d5a7d6a76d152105b987c5395c430abd259b0bf6e0a914b849cd7a860402cd1d974db4a9549f7ce039dc36fe0e532c79ae761841a786b7c551f2b17aac5929676aebcd501069f29983ca6326633f161ef2decef0ee96d8df5fd04e894da70cb37f1be7e1f72403158561ef60938ae4a194a4d7ffeffd64966c1e5c0f2d47f3dd8e8ccd80878fb3690db3b835a8a528f33225e4babd703d0ca0af7fb074fb1c34ac56ed8fce858a4293fe8b48fcb05c4670903798093115f94e6d36617325d1178b47ad5d950e49db68ff6f902d1a735cec6feeef9871779f403b5de4dfe01b4b2bf3b44d4cf439682e2c7207500835ae5ca9eb282e60128f5b9fedcff67cb131cd09d20b273f17997d294e5ac71b6d30dffd2489b88936ed5307c7584b57edeea0a0137207ebff9429c76185189c930c9fe416853cbb0feba79d3f3688649086b240d857f60e5edb0b52be759dabc43d833b21fe666e1d17f5dffa9fe0ee79a018ffb7c4cd67a6648d052770a8d93988d49e5547dd6cc9a96f28d39a45e92b1cbb38f25b57714b0bc4417b3d1b24aa668f65f69cfab9648cf6898bad72114377a674bbbcfe5f70b10550ebc4017cb0e0ff76f66483900bf5d8b86d385dfbb2c5b9009699eb718f38962686feb5ff21cd6bacd523d68ebea559ae9b244a288e6f4dff04fa37d806b925daebbcd8fa631c8b264ceb88052b360e586406f0203144f5a55c78073504e9858f28d63c7b6d948c60bc6d7396ecbc916b3d4ad7bf4f5e7f4ff145fa85c63f08bd35794b4f8640fd2d20bfb3d5dc1d89b4bd22d4bb494aee0fe08541189a171237b157bdd1f5525498bb33ee4989c7ef9e118ec8d3e299e459e28f148874d69eba1857e3ebac9f3c24f6986de21ff032088b2b7375f7d1d58948a9e75a4c0285a526e1ed7263d992d47a99e20e379dfd76bb2896448c14515db50706ec53e7565ab0eeec883035567564a952d73ed08254d9396b0e2f2ffce657ed8986a59157c71801c2419d476a90ff85975007fc56f235b446a8ddaf5a392c5cb28af7cc5912e343c9731bc09432b9c26a74e5a669a48a5fb7f52e0f7279b61a711348bf359aa061b64d67a2d42c3e66a91c2f5257bbf19bfb0d93f9db39bd517cbd7154bc01fc6a654b1c3bcd6d3f8ab77224067a66a1155a669ab134b17b6db3ec3e0a49fbbb0d2a0a6aa5f4d9380fe653a7f6b60006a7d36e02c35b27a3e37205e306f03df8d8a93603c19708e29a194b76c7dd651363aed1d94d3f4f97fe836d7649b7938ea4c8078196b6ec0f8564f745f49fc5dcae457ef9151a6a2b70a840ea42f0bceb59d45b820f4f735b1c76230448c651f990dd662948350d393210f93ccbd6aac48112a59604ce512e355a522f14b92a615eebee5d58805cec57f7e35bcb3dd22f50d8f00f6c1550d627151716ee55e4bf56540debc2354fefb721db26ebf655688cdb68d62e8668dd39ab7c082077a2d3fe5c691220a36bc629d73955c579ddbaa69b1ddbfea5b05d94e03a63ca0357254793f3bb6a3ad2687763bd2c49e166227a10bd8226d7809d0372df234d63ae02ab2e5c4e5f4b50513f45ea3d2c86dfd6422341038f24179517795ec275722d88d098f8948311894edd20df8a7f8513df5eb33411d77a600e4ad3608afffd74b5625f115170a59672519dff0e572b511c9a7f3bd04dadd69d1aba3107dae0014ab42cb6f46668320370a5eaf9a302dfa9dd7c8905656c2ba6a71430e96ed461d637f709766c8d16fa168fa755b5badf0b4fd04ec8f02cfaf6ce662e805941f9fbc695650560c9cb58dc1469fe6d4805d3abdf8542413799f8428e5fac", 0x1000}, {&(0x7f0000000440)="8ed49a0a98d215dd5666c0500d5fe790a49640f9b17db1a2f05d7ade35", 0x1d}], 0x3) 17:39:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:48 executing program 3: r0 = getpgrp(0x0) prlimit64(r0, 0x0, 0x0, &(0x7f00000000c0)) 17:39:48 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x7) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'caif0\x00', &(0x7f0000000080)=@ethtool_stats}) 17:39:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2400}], 0x0, 0x0, 0x0}) [ 80.643534] binder: release 3437:3440 transaction 114 out, still active [ 80.662565] binder: undelivered TRANSACTION_COMPLETE [ 80.690073] binder: send failed reply for transaction 114, target dead [ 80.699616] binder_alloc: 3444: binder_alloc_buf, no vma [ 80.719737] binder: 3444:3452 transaction failed 29189/-3, size 2097152-0 line 3137 17:39:48 executing program 2: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_mcast\x00') sendfile(r0, r1, 0x0, 0x88201) 17:39:48 executing program 1: syz_emit_ethernet(0x6e, &(0x7f00000000c0)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x38, 0x3a, 0x0, @empty, @mcast2, {[], @icmpv6=@dest_unreach={0x0, 0x0, 0x0, 0x0, [], {0x0, 0x6, "030009", 0x0, 0x3a, 0x0, @empty, @empty, [], "f601929f106531aa"}}}}}}}, 0x0) 17:39:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2400}], 0x0, 0x0, 0x0}) 17:39:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f00000000c0), 0x0) [ 80.742578] binder: release 3458:3463 transaction 118 out, still active [ 80.765193] binder: undelivered TRANSACTION_COMPLETE [ 80.776401] binder: undelivered TRANSACTION_ERROR: 29189 [ 80.782165] binder: send failed reply for transaction 118, target dead [ 80.851312] binder: release 3471:3479 transaction 120 out, still active [ 80.868316] binder: undelivered TRANSACTION_COMPLETE [ 80.870084] binder_alloc: 3474: binder_alloc_buf, no vma [ 80.870125] binder: 3474:3481 transaction failed 29189/-3, size 2097152-0 line 3137 [ 80.921554] binder: send failed reply for transaction 120, target dead [ 80.946485] binder: undelivered TRANSACTION_ERROR: 29189 17:39:49 executing program 0: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) 17:39:49 executing program 1: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 17:39:49 executing program 2: 17:39:49 executing program 3: rt_sigtimedwait(&(0x7f0000000000), 0x0, 0x0, 0x8) r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000008ff8)=0x3f) fcntl$setsig(r1, 0xa, 0x12) recvmsg(r2, &(0x7f0000000240)={0x0, 0x11e, 0x0, 0x0, 0x0, 0xfffffd17}, 0x0) dup2(r1, r2) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f00000003c0)=r0) r3 = gettid() tkill(r3, 0x16) 17:39:49 executing program 1: open$dir(0x0, 0x0, 0x0) r0 = socket(0x2, 0x3, 0x0) connect$unix(r0, &(0x7f0000000840)=ANY=[@ANYBLOB="82022e2f66696c6530001835a41d8c30df8d8373fb648b6d89851d31a4c96d9114902dad2652642ad710c03be48e61665b0900000066860828df8421d3430031cb19209eadbe536eb67c8a26ead8ad3a69ac5a42011edafc4cf5dca73c577829bab111bb7c857b9b8fe0f2031559074c16ef9e06f5271bce5ed8772a4e4bbabb76f279653733033b45bd632937a526e65300b700000000f100000d1b95a967c90fac571199169d196bbdb0c715c0fe2abbca36c4d179a3eb19996408215cb31bf68ac6fdb12503f30810567414ba464ba35d039ee4262c71805d12cb2819bd8723e26f4b6bd9671fa22f8fb099e3a00cfbc83284c769bde1c8a2dd6828b7fef63ba4f7d952e3daaf6b60c28ea5cfda139fb2218d607fea1020396caf61220eb6be16dad9605b29e0fbdc931565aee019f9b4d0a47000000000000000000000000000000000310975cc4925162721632a4971462f6249d79ef868f61d147f651a834f4e54"], 0x10) writev(r0, &(0x7f0000000640)=[{&(0x7f0000000200)="2828f975077018c2ff0195bb5dbfb0e416790bb19845fef6ab12b275fdfce5b8483164b80da65e1b056d09f082078d7889b1fa9f33236f495b6fa4a892f519a17e6c7223e4eae1fad17bcaafedba239949f127ca4e0da5804b5041650aaefd59295d965919c5cc8064c50ba47e6903cd8b55f34c5a138fb4914ebd8955e2229721ff9d8b970082921fe1c44b7fce8799c3a42cccd0f128b816467387a52701083ef97b1c2690d40799a677caa7151437120b169ca038fad76892843ff54fd44504005e86", 0xc4}, {&(0x7f00000011c0)="3c79e21fba9ba94883209b0095f7cc5268acaf1b827faea109245afb2da17de1a0eec777d7f1a25f915aa490dfbb91b91ae13267b42ad6a2cdc350a03623a7fdc3a33c486fbb6a6a10214aa4b4c864914f09c339d363683f42bc88a68bb0d3b21402365847f4587e36d99ec32f022e83d78a93d7ef3f9c1d38e3064b4cac12b5e7f9a0f68d7791244b38d13fa0a56e9b0b577c1aeaac7a9805bbcf7774ba5cc79235c7ac15922a0998c9cbe7413a0c5b4d24282643ca1f2394bd3259b20132c46d17db5c77a749ce8574bbf50a84f02e676571d866f22de1c4e30d08751106cc1cc1cdd98608ac268de8fb778ecf8802ce82c5f41fc8d033329d0e5eb56440f9e2a7a25618ad3352f635e3fd166c4809216de214f722e51efd02038489a03137b48f6f682f45c96a000fd696c76fbb525d0ede93c349f013f4a67933a3f2bc3ae5f95cba82f4afa5e011f3484bae242e41b37927151a4b8a052b9b85cecddcc6867727a0f9093d13241577bca189bd0cfc931f5b0ae632abe65032d2af3eb2c0adb5b111564ff16caf03f5a64fb7516f06b9a86c683ec0554c7432464610bd319a0ded3878aa5d5faf7fc6810fb9b85273a4e83daa1178e351c92e84f4e8992760ba2d18a94a5897ad45b8d18dd5717b1fdcbc83ef6dc0ea4df2e7dfd9f465ebffe22f21c62115c72ab50ad75683b687186c0333e335050650ea7f5490539b0966948e697389cb9dbf87905bb9c9f3f58b30642cabfbcfca74f6d36e9517eeda2902322e93c5a97fe2a12fd0547bc8ea4dfa03f70d5647d2a8fa8bf3bc5744c2ec0385a93bd85e2726ffbc15d4dbec94a2777e9bafd2c9f4aae0707a56827c61a823d333c3be62cfaba02b307c9a1f44723693aa20a8ab47387f11a55e1e6a5dfbc30bf64cad46c4068be1128d40f8cda2e01d663b2cf2bf2fffa42bcaf6b5151242021828d3a9d0779619e60faba20d3b5e46c09be1eaa01b37265231e26ccd55a9fc30320290afbdef8d5e86236b70b1f3921d584567907ab491057e9f8b5875bfd34afb81910b231f318884488f71427cfd1acd41b91b83fa2d7e92b34b48bcdf1918c50e3e9ed01cd2c18f9caee92e8ebad13492ac5f5bf1e1435deb8e610d668cdcd4f4ca553f2febddf2854555409adb9820c1a66e62f0aaa5e15b48e4ab1bd389ffba7dd4bba37119c2455a1345b2f8a5710b0c90c5355e727914d5ce3b45ce9649e224bf2a8ddd86e69f8c9dce8b38ca55a8dd5fd2ae24b5d0aed2d4d4e29ec2f0ea12ab570f15d8151a71c76cd957cf403cc13a6a7fbe85044a7bddc7fe9aa05aead2d2d02347efd9ee25f6c98b6a1732745daefc121ce7b3eb71298563ff40cad9f50eb593f4c7dbefef68607405071665ae76fff0c23d9d39e319266305e86c4ab217946f5be0bcd00e91111e2c3b88bbd7dd8055667899417a2a7e30b475c42ba0699b4a7b3c384b05bfeca51dc32a3df29067ffa0c7a928c40fa35ba7631c8c295aa513c36e18ce66ad3dcaea7c4a94df1747270ec5d2587144386fbba1b93689d1236dc8012998e26051af4eb6be04c1cebf3af8016c5e4fc1a7d41c6b2e3da8cb185690173c6d0a60ffa072799119ad98b6fefc729dd579b5a001b9cb90ff27c001027f7930989820ced7d9ac1937bcbba6e202d13059dd5ecbf28292a79f64e73a27959261f0de1d55459a4a7223df7cb2409d9e725650ce1a9cbf2dd69443084f27429981d330e45f180d1fe975202d8dc63852e6464deb2b6c6b51b45c29b501e1024f7d950686f943c940145f09e216399b25d771e521d41436550f328c4f74993c75243b4fb689c5f05056afcbbca0c19cad1ea4185b69e9d54fc6baecaf80f55e26ea159876033579ffa9841da40e3718410da326db6d1114e5fddba0023779af920e62c9b4c1358a89e273520ccc51eb5ab474e09e406ac814c5fda291ea91fb879e1b487d5062a550fddb9d04bcfa99ed02cace18c78c7d466e5b6fedc8a1dbeef8e32bb9507b99d98c366d8ab0aca760d4787d443ba161d967960b775f17fbc5178a6d2211c398f49db330291c98990ea736bf1a6323dbe42c97e30a0a8fc7843dfef41f59526715d6b4f416b773dc134753a704c6fedbfe09fc21783ca39f4e6d580db9c4833bac8e76979434c066069af973cd8494e3232be631d9055e287514fd68aeac3e2c68c96ce188619080ef609564d4198805bb294bbe81509489779d0e0d79cf6ef1ebb47531eca04232fb5fce2ebed9081de6495c9bb2146917d5111c3538f99a4d9da0d5b920589df248d4898d48e475aa4fb583dded56488d24a5ba33cd445d2df252b78e0a918a59a5b0632bebd9f7c6c2dd273643177f68b1bb69770ce2b108c7da4e73b714d667ae476a2763290c1d530f150891f778add0f8b7d9cef38a5820dd2864cbb257196824664c14f62d2fc731467f487fadafd57cb297bebad59d6dfdda2f990806026559b7b49520121df714fd75f61836ed0dace07376dca0aaf435c6b7c75a3f75cfa74ab7d8ac4715e24bf35dd1bbc952c7f77817c8131fde56470a63e41aa3fc9bcc64cb824b6b6c03fd0d7530afa42a02c3917ac3ec27a7ef304a794c4889e76fbdeaf939e53bc0a548de2a33cea292b09066542802a3493245523eb1ebb08fef47f63d094c30ef5ccf2c242dba94121684243f160dd5c601fe81407eaff2f6abc9bd159db619adf4ac3f670e00efb143ba49d92e2152f77046fbcc457a30c07655e245e51df79606a27b50aa31c4697610111ee899b395ffc76121d5e2e3d36145d9551a39bc9e1d1d80ba4e5caedfb8836ce49c779c7e2da3ce4a3b42189bb29f4aca5e4b381b0bc86dc7f83be4f5fb4885710411baebaa2e828826a3c097c2862924af173d79118a413d17df56058c5a146dc89c443cb3967b1c7a6954d8fafeb7927aecef030bed2a146d74e2273a9ac18424d4b28142b8f2232da48cb771566b9641c1c725b1eb52c2b6efe8d754c8cba3bebc20e74f1ce0725ef334a92ca90434d9bce6c77419772c430f1425a3edafa5ea477899b8c9b0b486be3a8473ace8f8589e1390ef4dbc039012386a93bad636e50ba7056169de2c075032ea1112e807b3373e3841cce1ade0ae9205d2938a1a3f7f6a9436dc5c9ca847230d3eff9d59025e43024b83a44f781d6f07781b79a69a7867aef1d5ab8b4bd9b5538f1cae58bd943d5f5c55d91162baabca571b1757ad0f53fff6593b24dccea3933c656fe89a102e0dfbbf36147f9f509190795ff8183a6f5d573aee0cf06ef9be29f3a72964f5cb0c6df916c49c28192a54ac95764d4f895c01e51dc31d73764781f14e56a437f2aa96402de93c64919a6452cae172e26cbb5a77a21a1df664b87f9e7fa45006d20333427ab12d2846fca0a4c0cc48f99b3c0e7e7c5b47e70caff208b932f156b37b96c53fe1642ae93c470526ace47f4602c139c7094b19faa8287db3101c20cb4d4e409311faa9e3e37b7766110a5680717e930a9298913e814cc9d193666f6ec763630089563d5a3991623eb467d8244501ccc323fe6a131bd03630165db3255b5b303cb98b3a8af90dd8f5dd79108caea557211e8b927b211f3960fc75a4a55aa271aae555a13719a34d8358814ea62ed55de10cf76272b2d769cf7a32d4d98d7bd8f43d699e4eb24196d844a10074f9af3b445107b5c3cbc99f77f3c1866b95246fad15fe0168728f066253675e229cd818c8538cfcfc54208e7679f9b05b7e469bb4bafa73fbf113940b47409442859aaf5ff41a820140fa58373ab937fca62a3893e9cf290e4649b38dde07a4d7f63389e96c85f1e25a93b39b676eaca5f7ee13fc7df833f04f70f32171cd3c081b6a2eb2f2042f530f8c7fac40cdf11df48af5c04ea2acb7e26ffc6ebbdbdf0827901417864891c1cde57a5a97537a681492becf533537d5a7d6a76d152105b987c5395c430abd259b0bf6e0a914b849cd7a860402cd1d974db4a9549f7ce039dc36fe0e532c79ae761841a786b7c551f2b17aac5929676aebcd501069f29983ca6326633f161ef2decef0ee96d8df5fd04e894da70cb37f1be7e1f72403158561ef60938ae4a194a4d7ffeffd64966c1e5c0f2d47f3dd8e8ccd80878fb3690db3b835a8a528f33225e4babd703d0ca0af7fb074fb1c34ac56ed8fce858a4293fe8b48fcb05c4670903798093115f94e6d36617325d1178b47ad5d950e49db68ff6f902d1a735cec6feeef9871779f403b5de4dfe01b4b2bf3b44d4cf439682e2c7207500835ae5ca9eb282e60128f5b9fedcff67cb131cd09d20b273f17997d294e5ac71b6d30dffd2489b88936ed5307c7584b57edeea0a0137207ebff9429c76185189c930c9fe416853cbb0feba79d3f3688649086b240d857f60e5edb0b52be759dabc43d833b21fe666e1d17f5dffa9fe0ee79a018ffb7c4cd67a6648d052770a8d93988d49e5547dd6cc9a96f28d39a45e92b1cbb38f25b57714b0bc4417b3d1b24aa668f65f69cfab9648cf6898bad72114377a674bbbcfe5f70b10550ebc4017cb0e0ff76f66483900bf5d8b86d385dfbb2c5b9009699eb718f38962686feb5ff21cd6bacd523d68ebea559ae9b244a288e6f4dff04fa37d806b925daebbcd8fa631c8b264ceb88052b360e586406f0203144f5a55c78073504e9858f28d63c7b6d948c60bc6d7396ecbc916b3d4ad7bf4f5e7f4ff145fa85c63f08bd35794b4f8640fd2d20bfb3d5dc1d89b4bd22d4bb494aee0fe08541189a171237b157bdd1f5525498bb33ee4989c7ef9e118ec8d3e299e459e28f148874d69eba1857e3ebac9f3c24f6986de21ff032088b2b7375f7d1d58948a9e75a4c0285a526e1ed7263d992d47a99e20e379dfd76bb2896448c14515db50706ec53e7565ab0eeec883035567564a952d73ed08254d9396b0e2f2ffce657ed8986a59157c71801c2419d476a90ff85975007fc56f235b446a8ddaf5a392c5cb28af7cc5912e343c9731bc09432b9c26a74e5a669a48a5fb7f52e0f7279b61a711348bf359aa061b64d67a2d42c3e66a91c2f5257bbf19bfb0d93f9db39bd517cbd7154bc01fc6a654b1c3bcd6d3f8ab77224067a66a1155a669ab134b17b6db3ec3e0a49fbbb0d2a0a6aa5f4d9380fe653a7f6b60006a7d36e02c35b27a3e37205e306f03df8d8a93603c19708e29a194b76c7dd651363aed1d94d3f4f97fe836d7649b7938ea4c8078196b6ec0f8564f745f49fc5dcae457ef9151a6a2b70a840ea42f0bceb59d45b820f4f735b1c76230448c651f990dd662948350d393210f93ccbd6aac48112a59604ce512e355a522f14b92a615eebee5d58805cec57f7e35bcb3dd22f50d8f00f6c1550d627151716ee55e4bf56540debc2354fefb721db26ebf655688cdb68d62e8668dd39ab7c082077a2d3fe5c691220a36bc629d73955c579ddbaa69b1ddbfea5b05d94e03a63ca0357254793f3bb6a3ad2687763bd2c49e166227a10bd8226d7809d0372df234d63ae02ab2e5c4e5f4b50513f45ea3d2c86dfd6422341038f24179517795ec275722d88d098f8948311894edd20df8a7f8513df5eb33411d77a600e4ad3608afffd74b5625f115170a59672519dff0e572b511c9a7f3bd04dadd69d1aba3107dae0014ab42cb6f46668320370a5eaf9a302dfa9dd7c8905656c2ba6a71430e96ed461d637f709766c8d16fa168fa755b5badf0b4fd04ec8f02cfaf6ce662e805941f9fbc695650560c9cb58dc1469fe6d4805d3abdf8542413799f8428e5fac", 0x1000}, {&(0x7f0000000440)="8ed49a0a98d215dd5666c0500d5fe790a49640f9b17db1a2f05d7ade35", 0x1d}], 0x3) 17:39:49 executing program 2: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 81.488122] binder: 3492:3495 got transaction with invalid offset (0, min 0 max 0) or object. [ 81.492225] binder_alloc: 3489: binder_alloc_buf, no vma [ 81.492266] binder: 3489:3491 transaction failed 29189/-3, size 2097152-0 line 3137 [ 81.510456] binder: undelivered TRANSACTION_ERROR: 29189 [ 81.524630] binder: 3492:3495 transaction failed 29201/-22, size 0-24 line 3199 17:39:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 81.538826] binder: undelivered TRANSACTION_ERROR: 29201 [ 81.559399] binder: 3505:3506 transaction failed 29189/-22, size 2097152-0 line 3014 [ 81.572175] binder: undelivered TRANSACTION_ERROR: 29189 17:39:49 executing program 2: [ 81.601024] binder: 3510:3513 got transaction with invalid offset (0, min 0 max 0) or object. [ 81.616028] binder: 3510:3513 transaction failed 29201/-22, size 0-24 line 3199 [ 81.651863] binder: undelivered TRANSACTION_ERROR: 29201 17:39:49 executing program 0: 17:39:49 executing program 1: 17:39:49 executing program 3: 17:39:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}], 0x0, 0x0, 0x0}) 17:39:49 executing program 2: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 81.701445] binder: 3523:3524 transaction failed 29189/-22, size 2097152-0 line 3014 [ 81.714971] binder: undelivered TRANSACTION_ERROR: 29189 17:39:49 executing program 1: 17:39:49 executing program 2: 17:39:49 executing program 3: [ 81.767751] binder: 3533:3534 got transaction with invalid offset (0, min 0 max 0) or object. [ 81.787389] binder: 3533:3534 transaction failed 29201/-22, size 0-24 line 3199 [ 81.801547] binder: 3535:3536 transaction failed 29189/-22, size 2097152-0 line 3014 17:39:49 executing program 2: [ 81.817576] binder: undelivered TRANSACTION_ERROR: 29201 17:39:49 executing program 3: 17:39:49 executing program 5: [ 81.840989] binder: undelivered TRANSACTION_ERROR: 29189 17:39:49 executing program 0: 17:39:49 executing program 1: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:49 executing program 5: 17:39:49 executing program 2: 17:39:49 executing program 3: 17:39:49 executing program 1: 17:39:49 executing program 3: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:49 executing program 5: 17:39:49 executing program 2: 17:39:49 executing program 1: 17:39:49 executing program 0: 17:39:49 executing program 2: 17:39:49 executing program 5: 17:39:49 executing program 3: 17:39:49 executing program 1: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x2b, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:49 executing program 2: 17:39:49 executing program 1: 17:39:49 executing program 3: 17:39:49 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:39:49 executing program 5: 17:39:49 executing program 2: 17:39:50 executing program 0: 17:39:50 executing program 1: 17:39:50 executing program 3: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:39:50 executing program 5: 17:39:50 executing program 2: [ 82.295087] binder: 3595:3597 ioctl c0306201 0 returned -14 17:39:50 executing program 1: 17:39:50 executing program 3: 17:39:50 executing program 5: 17:39:50 executing program 2: [ 82.381610] binder: 3605:3609 ioctl c0306201 0 returned -14 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 17:39:50 executing program 5: 17:39:50 executing program 0: 17:39:50 executing program 1: 17:39:50 executing program 3: 17:39:50 executing program 2: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:39:50 executing program 5: [ 82.501686] binder: 3619:3620 ioctl c0306201 0 returned -14 17:39:50 executing program 1: 17:39:50 executing program 5: 17:39:50 executing program 2: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:39:50 executing program 3: 17:39:50 executing program 2: 17:39:50 executing program 0: 17:39:50 executing program 1: 17:39:50 executing program 3: 17:39:50 executing program 5: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17:39:50 executing program 2: 17:39:50 executing program 5: 17:39:50 executing program 3: 17:39:50 executing program 1: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35], 0x0, 0x0, 0x0}) 17:39:50 executing program 2: r0 = socket(0x22, 0x3, 0x0) setsockopt$sock_timeval(r0, 0xffff, 0x100b, &(0x7f0000001940), 0x10) 17:39:50 executing program 5: [ 82.897657] binder: release 3669:3672 transaction 144 out, still active [ 82.907027] binder: undelivered TRANSACTION_COMPLETE 17:39:50 executing program 0: 17:39:50 executing program 1: 17:39:50 executing program 3: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35], 0x0, 0x0, 0x0}) 17:39:50 executing program 5: 17:39:50 executing program 2: [ 82.939230] binder: send failed reply for transaction 144, target dead 17:39:50 executing program 1: 17:39:50 executing program 2: 17:39:50 executing program 3: 17:39:50 executing program 5: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35], 0x0, 0x0, 0x0}) 17:39:50 executing program 3: [ 83.017880] binder: release 3686:3687 transaction 146 out, still active [ 83.040941] binder: undelivered TRANSACTION_COMPLETE [ 83.053121] binder: send failed reply for transaction 146, target dead 17:39:50 executing program 5: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x27, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR], 0x0, 0x0, 0x0}) 17:39:50 executing program 1: 17:39:50 executing program 0: 17:39:50 executing program 2: 17:39:50 executing program 3: [ 83.114908] binder: release 3695:3697 transaction 148 out, still active [ 83.121909] binder: undelivered TRANSACTION_COMPLETE [ 83.139874] binder: send failed reply for transaction 148, target dead 17:39:50 executing program 2: 17:39:50 executing program 5: 17:39:50 executing program 3: 17:39:50 executing program 1: 17:39:50 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x27, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR], 0x0, 0x0, 0x0}) 17:39:50 executing program 1: [ 83.231981] binder: release 3709:3711 transaction 150 out, still active [ 83.253927] binder: undelivered TRANSACTION_COMPLETE [ 83.259167] binder: send failed reply for transaction 150, target dead 17:39:51 executing program 0: 17:39:51 executing program 3: 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x27, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/35, @ANYPTR], 0x0, 0x0, 0x0}) 17:39:51 executing program 2: 17:39:51 executing program 1: 17:39:51 executing program 5: 17:39:51 executing program 5: 17:39:51 executing program 3: [ 83.342095] binder: release 3721:3723 transaction 152 out, still active [ 83.352579] binder: undelivered TRANSACTION_COMPLETE [ 83.361114] binder: send failed reply for transaction 152, target dead 17:39:51 executing program 1: 17:39:51 executing program 5: 17:39:51 executing program 2: 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 83.436181] binder: release 3731:3736 transaction 154 out, still active [ 83.443106] binder: undelivered TRANSACTION_COMPLETE [ 83.491131] binder: send failed reply for transaction 154, target dead 17:39:51 executing program 0: 17:39:51 executing program 1: 17:39:51 executing program 3: 17:39:51 executing program 2: 17:39:51 executing program 5: 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 83.539797] binder: 3744:3745 unknown command 536871104 [ 83.548582] binder: 3744:3745 ioctl c0306201 200002c0 returned -22 17:39:51 executing program 5: 17:39:51 executing program 3: 17:39:51 executing program 1: 17:39:51 executing program 2: 17:39:51 executing program 5: [ 83.626128] binder: 3755:3758 unknown command 536871104 17:39:51 executing program 3: [ 83.671117] binder: 3755:3758 ioctl c0306201 200002c0 returned -22 17:39:51 executing program 0: 17:39:51 executing program 1: 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:51 executing program 5: 17:39:51 executing program 2: 17:39:51 executing program 3: 17:39:51 executing program 2: 17:39:51 executing program 1: 17:39:51 executing program 5: 17:39:51 executing program 3: 17:39:51 executing program 1: 17:39:51 executing program 2: [ 83.821346] binder: 3776:3780 unknown command 536871104 [ 83.843180] binder: 3776:3780 ioctl c0306201 200002c0 returned -22 17:39:51 executing program 0: 17:39:51 executing program 3: 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:51 executing program 5: 17:39:51 executing program 2: 17:39:51 executing program 5: 17:39:51 executing program 1: 17:39:51 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$sock_int(r0, 0x1, 0xa, 0x0, &(0x7f0000000280)=0x36f) 17:39:51 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sched_getaffinity(0x0, 0x8, &(0x7f0000000040)) [ 83.962445] binder: 3796:3797 unknown command 536871104 [ 83.979483] binder: 3796:3797 ioctl c0306201 200002c0 returned -22 17:39:51 executing program 1: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000140)="240000002e0007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000002b80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 17:39:51 executing program 5: pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) splice(r3, 0x0, r0, 0x0, 0x5, 0x0) 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 84.121080] binder: 3818:3820 unknown command 536871104 [ 84.139908] binder: 3818:3820 ioctl c0306201 200002c0 returned -22 17:39:51 executing program 0: r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x2b, &(0x7f0000000280)=0x8, 0x4) 17:39:51 executing program 3: r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x2b, &(0x7f0000000280), 0x4) 17:39:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000480)={'ip6_vti0\x00', {0x2, 0x0, @broadcast}}) 17:39:51 executing program 5: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ptype\x00') sendfile(r0, r1, 0x0, 0x88201) 17:39:51 executing program 1: r0 = socket(0x11, 0x800000003, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @multicast2}, {0x0, @broadcast}, 0x0, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'veth0\x00'}) 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:51 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f0000000000)=0x21, 0x4) 17:39:51 executing program 2: syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/icmp6/\x1c\x87\x13\xb9\xe3\xa5\xdb]\xc0\xbe\xf3\xac\xbd%>\xe4F\x1e6^%h\x95\xa5\x9c!\x11\x92A\xff\xeb\x8d3O\xab<\xd2\x12\xdc}\x97,j\x00W\xb0\xc6\xf7\x9cl\x03\xfc\x17\xe6\xc1\xb0\x1a\xe0`V\xa6+\xd8\x98\x8f\x80t\xc1El\'-2\x9a\xe9ND;\xa5\xcf\xec\xea\xfe\xa8S\xac\xbbb\xbe\xca$\xfb\xf4\xee\ti8O\xbdX\x92\xc3,\x00'/129) 17:39:51 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/tcp6\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000200)=""/130, 0x82}], 0x1, 0x0) 17:39:51 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x16, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/18, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:51 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) recvfrom$inet(r0, 0x0, 0x0, 0x1c102, 0x0, 0x0) [ 84.227553] binder: 3838:3841 unknown command 536871104 [ 84.238869] binder: 3838:3841 ioctl c0306201 200002c0 returned -22 17:39:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x8, &(0x7f0000000100)={@mcast2}, 0x14) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) 17:39:52 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) keyctl$set_reqkey_keyring(0xe, 0x2) 17:39:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000180)=0x3, 0x4) 17:39:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4}, 0x68) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x16, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/18, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:52 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f00000000c0)={0x0, 0x0, 0x0}) 17:39:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) recvfrom$inet(r0, 0x0, 0x0, 0x2000, 0x0, 0x0) [ 84.348658] binder: release 3851:3856 transaction 162 out, still active [ 84.358470] binder: undelivered TRANSACTION_COMPLETE [ 84.379003] binder: send failed reply for transaction 162, target dead 17:39:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto(r0, 0x0, 0x0, 0x20000000, &(0x7f0000000040)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80) 17:39:52 executing program 1: r0 = socket(0x11, 0x800000003, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x0, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {}, {0x2, 0x0, @loopback}, 0x4, 0x0, 0x0, 0x0, 0x6}) 17:39:52 executing program 5: syslog(0x3, &(0x7f0000000380)=""/206, 0xffffffffffffff1d) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x16, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/18, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 84.447953] binder: release 3869:3878 transaction 164 out, still active [ 84.474634] binder: undelivered TRANSACTION_COMPLETE [ 84.494231] binder: send failed reply for transaction 164, target dead 17:39:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/169, 0x2aa}], 0x1, 0x0) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/27, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 84.533996] binder: release 3885:3888 transaction 166 out, still active [ 84.543998] binder: undelivered TRANSACTION_COMPLETE [ 84.552017] binder: send failed reply for transaction 166, target dead 17:39:52 executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x0, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {}, {0x2, 0x0, @loopback}, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3c2}) 17:39:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/tcp6\x00') preadv(r2, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/213, 0xd5}], 0x2, 0x0) 17:39:52 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x13, &(0x7f00000001c0), 0x4) 17:39:52 executing program 1: unshare(0x20020000) clone(0x3000000881d8d01, 0x0, 0x0, 0x0, 0x0) 17:39:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/dev_mcast\x00') r1 = eventfd(0x0) sendfile(r1, r0, 0x0, 0x20400) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/27, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 84.618485] binder: release 3896:3898 transaction 168 out, still active [ 84.631911] binder: undelivered TRANSACTION_COMPLETE [ 84.654498] binder: send failed reply for transaction 168, target dead 17:39:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000040)={'\x80\x00'}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f0000000040)={'\x80\x00'}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$revoke(0x3, r2) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x1f, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/27, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:52 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f00000000c0)={0x0, 0x1, &(0x7f0000000300)='y'}) [ 84.710661] binder: release 3909:3915 transaction 170 out, still active [ 84.748407] binder: undelivered TRANSACTION_COMPLETE 17:39:52 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = socket(0x10, 0x2, 0x0) sendfile(r1, r0, 0x0, 0xa805) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/31, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:52 executing program 1: r0 = getpid() rt_sigqueueinfo(r0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x80000000}) [ 84.776963] binder: send failed reply for transaction 170, target dead [ 84.794575] binder: release 3922:3925 transaction 172 out, still active [ 84.826821] binder: BINDER_SET_CONTEXT_MGR already set [ 84.832405] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.838975] binder: undelivered TRANSACTION_COMPLETE [ 84.850427] binder: send failed reply for transaction 172, target dead [ 84.858088] binder: 3931:3933 ioctl 40046207 0 returned -16 [ 84.865902] binder: 3931:3933 transaction failed 29189/-22, size 0-0 line 3014 [ 84.875579] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.875883] binder: undelivered TRANSACTION_ERROR: 29189 [ 84.900792] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.910645] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 17:39:52 executing program 0: clone(0x3000000881d8d01, 0x0, 0x0, 0x0, 0x0) 17:39:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/dev\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/169, 0x2aa}], 0x1, 0x0) 17:39:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/31, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:52 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000b6dfc8)={0x500, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYPTR64=&(0x7f0000000080)=ANY=[@ANYRESOCT, @ANYRES16, @ANYBLOB="aa0533fcb3210791040000000000000035073d62689e5a111ac7c66d2db68dfda14d363a41afb8eefbde7a100c0ce38ff74f487e8c54ff70"]], 0xffffffbe}}, 0x0) [ 84.920406] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.930288] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.939968] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.950890] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.960681] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.981458] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 84.994633] binder: release 3942:3944 transaction 175 out, still active [ 85.015356] binder: undelivered TRANSACTION_COMPLETE [ 85.029312] binder: send failed reply for transaction 175, target dead [ 85.040977] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.052603] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.066103] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.082389] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.092313] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.109735] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.121957] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.132661] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.142492] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 85.152577] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 17:39:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x13, &(0x7f00000001c0)=0x5, 0x4) 17:39:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x23, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/31, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:53 executing program 1: pipe(&(0x7f0000000340)={0xffffffffffffffff}) fcntl$lock(r0, 0x25, &(0x7f0000000240)={0x1}) 17:39:53 executing program 2: syslog(0x3, &(0x7f0000000180)=""/200, 0x48f) 17:39:53 executing program 0: pipe(&(0x7f0000000340)={0xffffffffffffffff}) r1 = gettid() fcntl$lock(r0, 0x25, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, r1}) 17:39:53 executing program 5: r0 = signalfd(0xffffffffffffffff, &(0x7f00000008c0), 0x8) poll(&(0x7f0000000980)=[{r0}], 0x1, 0x0) 17:39:53 executing program 1: socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) sendmsg$inet6(r2, &(0x7f0000001680)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000280)="981a079f903ec12d0e078875c31296bc93b66ba7f15198d47b0c6006906d0563ab921b9ee99d3378032dca3e2020737dd118a651b9f7aab7b8b6e7d05212e50c1f8097d61dc304cf67c07d294d", 0x4d}, {&(0x7f0000000300)="c0f6c787095190d0c2d72e4c0777fb488936e8fae8dd8908e76809f8804bdb9437c70aaef606ce90826d2fc83fbf42c15f7ed96e57af363df199d16ed0d55b36879c717cfddea7eedadfad337e603f9de9844e4447636b040703b75810c95d4409475e1037d97e85f789f4eb71972a6dfbfa65ddd74664f3d82f17c72eb21580c13dc6a9e5e04b11729cd0281de94318a869efd014146c285db324bc87d4e0db3c7e2ec1507c43d684f8aa67b39e097e69b241d6e756733c581400d883451692105ea0", 0xc3}, {&(0x7f0000000400)="c3d8358473aef3e750e2b567a4b1c901895197698fc73f813c18d769e89b51bef84aeb2189610271d9aec9c1d4839c91d2", 0x31}, {&(0x7f0000000440)="a44d73d4adb756f9f7e7c433829bc39a23c4c40f21b34c032939fdd5ed6bf808967d09e010ed41dd61850c6312275d8e44d306ff8eca0bf2c4a6bffd6a4babc3c0a8bee9f66443d674a05c1e6e5e753c87fbf4bdb482790f53c1870a7421058ad7ae7e801d1d01f89c14d19659a379b0ad89bea19598b90c132e65b4d62a39629f37df14cb260225ff19fae54761430217ed513abab9fc7da001b25fad550579b14444a4eba36c632ba5a18d2e1ef6f72792ddabcc2915286bc74df1907468b82e8aea5a29f3b6464756dae7e367f90ba904252a3eeca1b43a8182a513549a063acd983263cd7f383ae68c43986ab33d25cbf072be8aa856d358bdd3add3e5daa914aa066266616654cf071e36137923258b4f7d2246d25e988826856091a34c0fe7d65bcbb569b7aa1a8b95a96977580e26eb0e43bb7f5d7b4b2340db155527cc64f37a7c60e2b1447e9d69b42202939413bba4f515e5dbac926460edd61ef365d4e2cc80747841965c1317da36f934d7de267ac9a654e9f384f15b9f400c83a92ed49a36cd5fc3ba093534455997682adff621d52aa5db9456c9312338fb1571e7c2ad7142566df99ee05a4e8735b3ad2fa48441d527bba772080c913521ad50385b3af0d6707338a3a1cb7787fd5ca39f2215c724ed1c231e9c3edabc9610d2d7b63aab0029675d1f61cdb785f16a2f58b6dc4a0c366e094ffaf96bf51dd7f9ac9fd14efa08d71724d401a932cc90415cb2b385cc18a23d3c257b5a8f277afba9d1650f33a5729037b9e95e961516fa02cf273e811d0e68741b14e640d206204da727271a2568f8cc091b8ac736de89ced6cc284621b735e10f70fee9b6a6e007e7695c4c0fddc270c5e6fbb17042b72ae40480cd77a27a94320182d33f8fb2e0bf36670a83b56fffe80382fcce5156af2e636541c0246a7a069f80f01c5711e9c9ed851800197cf074388f9874821066a4772feb52a92f80a8547c53120c622cb0c2a142cec3d0790962b00be6cf360fdaf1d2a9e283a19e5877f6b0ea9d9483b3ed3bc94aed351e04e4a01dbfaefd241271f4a77dca69107f0f23bcffa2ae73fca27fb76f6214aadc281761ed4569d6586cfa6322749e6516647512ebfa1a2cb6dba73b1260f9172309e2549ad07e21d40f52b1e7dff413dccd3df89c50e4933432f4bdba57f4f5b7b37e9a7df8d211c065b1d071f9c0b6a0b7ee70a1dff333d538328aac76873dff4684780ddb312f840aaf2eaba766e9f626779efd7f298e85b0b9e98422bc0529db6afa2c4db69def03f2e668fe01923fc418d8249bb54a29aac348f205a208e3bbc28283b16bcc8dbe036bf4acace050610eae8cda57f33225eba82ce9064398838b7688e9eb88a67969f52bc148c1d4a9a2bd8e8ffd0baa10be326d9d8dd7d39dd08e18157c8ba48817e1a5df43ff4f271c9b323195c0d183b34a157669496bcd965870acd153f73e78a67216d51db76e5d390f3e7dc51148426ad75b183f318dec726f8f9a3c417d009557367e9656fdc579646da8345c7f107c1845ff56e194522e62cba89a6f7f3e2b2cc4a6efee22a99c7177a472e20f60baa7891e95b84ae9ba00e23ca5e75a054b2deab3acb95ad5acf208850395943d54a13cde20d254bc8cb5f782f9b5c331d6f8ed96d81a101c3d014c9a5dc4161d174f61cb0aadca8b4fb6ad6a8b1652f1e5ff28e6b278e2a5782863b85235e90b1248b71d71c64c127ef144043cf7b3f2634aa67d38441b56ca063ac9aabe0d84edab9ac130c557a6710ee53f2b6f0f517f56d7179376538dede629fe457829a118fa21cfb737dfc0911e43973a37016f06f444f7119ee721a864d2d882169980466a4390df7f68794409464d57b6e3f125ee79f970b7273dd70f03124e297d474b828d55837af61b85276291bba551268d4682557e65045151d1113fa43def36ae8d406f8217068497e1db4efcdedd73832f46ee34f92d5cd5b51b0ff2818e9618ab2601d6b59bae6f7d712a5913e74524349650bbed104d59dc998bb72baa80ec2dece34d8c98aa9a35d35e5bc376e68f100f186cc29c3b2d2fa9e13fc449dc9e5c8665e6f8fc5bb2535a933d5ce418b7baaea013983eea10fe1bd289ecb19d778507aca614af158218bcd7b8adb1f4edebad2d01f5de2fcb0cc42f68d632574484f9dffb4f38d5109f51f58b047b9595c5a6012019458e4c6c7637ca6023a99beffa878f942a5ea9914f5a7ffb7f8fac08b3056488222508d30651f76874165ec27b50cc0d88b556ec8c8fb6d6415eec2ac58ca4aa96924db6bd23623f599c3c04afccc14bfc5dc1fea26537e3b595a9c4635e26f1754093d55fa05f4420484ade47861fc2e6a0cb644f5750708224ee4f2abc57d47b1513dc26a586d823635e6a33ed31503f3fb0258533fb366ad5acb0d4dbd17035341c12d945416a23308d182fa4d0b6ab563c106b4fc999ca950a880f331e40cda84dbad95d29d29a39baf499ce726854ca9f078014884d1e8895651ce0c6b630ec16cfb2199ccecbc8434eb7b7dacc802ee678764f45bbc717576c6aab58def4b0fe7458a42b74108ddd4ce218c76c2cc47f9070b22e7d5386f4426c33ccaaebf564e35bfa198c806c3b47cae4cabc2e9333ee1232c007b9f46c36da0fc71f9b769b7fead207e07859590dfa7dc4846a28b1914ef85a64ae5f9081fbc16ba86ca4c293d7247bd163fc00ec5542dd8e6bb949d922b75643364636c3d8b73d4700bdafcf769d81ceb7cea67ba4ad364eef003d756de14bd7ffb1aae0c0b25336a19110c1652a71ea6c1863ed1f57f3d8f5cc16f760d6231edda760d406649efd13800c571f5ed15830e240308ae5e8baef3d26bee432711017bf6e504454bc83b5aea73893374032cd0ab682486a6c5f60cb22ea2d0edc12b55ad9536624797707ae5d905ab5148f986674ded251a45439a60458089501108dc8478cecf6b005563cc29a63fa9fe01bca0cfcef12477bbf6e0d20ba14a7ca816d58e874cbd9a9ebf99ff71d7b09f35efe786616d65ffff5ac15ed7575d683750e1e000e1a960912b79427c818587e0d4a4e8b098a569607153612ee5620fb601004b3f1b9caffb4748d502b1a1fcb599508b213a5c5c6fc57a93c5e2c74c22ca4f86b084858cde13db7fa98d021a5733bb65aad81fd4f936290b3279c0d268016ddc64b4648691889a17598bf1b44662786a75a2626859ddfe55baf6fce537c1e316aede2b964d002194c646b0a94747629a13e75a4fcc265d32d6c8e6eaa087abb8a5d1adba1947cddfc2f6f780043437208f736da25ce43bec8df244fde24a2ee8311f19171fd8761ddb631689b4947bce05b5f5f05d0f64442aeec47bd68b03028dcb5c87867d63ec03957e37293c5bc10a04f975ad7d27216476336d10bb56be3126eb453b0f3206d91a0eae710535a0119d686c2ce924805daf796ab04028cbabed534428b6bf9920c08e3a0679c57cf98bb76f993e7629f82ec21d9c0c6cbe3c2dbc4603c98d7940e660ced1c86b1f2e8cccdc3f692ce05f3f334cf0404bcb11c182a6af455f667d7a26e70228002320829d5b3236263c42def02518a9deb5e5f976d27424daf5bf9303e8622229ad5182430a8650d78872db04309461f57e95391ac468ed3273857de78dbc36b68dbe151f2d06eaa743dd2538d55a8a317796d9634eea6da9bdd27b17c7fc165d37868faab81ae234646102842805ab798013517e315b3782fd77aee1f15c81e327893481529448ac16cce166a98cd6d1822341ac69f083462cdcc5cf2ce377f933d34b6c3edfab54c290392b178af58df47f8c9dcddfe902cab0079d8b17610fe7bcd0650f4b0998bb4a6b4d3640ebf84cb9a716562f333df7f1b8cdf80d8382ce1b921daba0c51864c0ae4e982fb3a86c00d7fd6df7a8aba971d4b714219538fc53c72ae31802a67e4bdf89ece812734f3ecd3298927b0b28edf4cbb5ce69350ff04245d6a7eec890d886ef26b2a1a8ea21e70f112e51c0811584e55b645fc79046b51e03fa81e864ed56404f8f1a131b4212aba0b5910200dfdee98f47d2e4b719f941bd2cd8b364a4df505f99df2d0c05a225e7c84c86faab11abcb6f68459d677da13a57b87a59c65e899279083a990926eeaa9a62186f1db4617aedb407610590f3f94e3c6fd42f11b3b17712502a52fc628c1745b93035a6b2dfabf6c393ba757cfacd442d3db9848374061a639da31967fb8cbef59c50b8927662acad0251a32cc3c34664927e3525deb36431c3f4f6d758bad2dbe17edf5ccfad5563c9f979441a471c290948eb3f77645a60e4e9b71b53a9c79bc73eda199056bd8f6ccaf63ccbc718a50357b01267b22b27613dac9859a0355819774955b0ef1dc0d776eeb34e7a5b421fb058d1e5abb02ad951d95bcd4959e865ef143d52778f3d439ddf7dddd6dbdd44dfc003f2392688daa090dbb5e1f7ce72f7a8b7b271b37c8e8e48bcbc389fd509d5bf42402d54e6dad672321a178a2bffc7addc35d92f85f8ae1843e58541b5f5944689cbf52f3bae3a68dfde66e7ea324f36e9bfc7c449e6b9fdb48d6e5baa2a32b9deb88b2576e6f528a6c822503194dcab75dff5f941ecc2346bfc3438c5b28dc7621f4d343ed043fe1d2d47097341584d521956ac98151f5125b7040f957c2a99e6d7c52b59e3469737140349e6e900e66656d874321db54ec6665d3282e6228c005a7c5f0a4913e14c5c0ef51096bc15b81feb44f933035b58392eb89a28b7c5d175649789d1af644cbae725f4b3f4777cf38ad4ac7ea08ccc63cfffc8343568f12564fade7c10c0780058d204cb49ab85c26b7e36891cf67773a4aa98a6f9d6df6a641aadae659d69db1e0910fa8", 0xd7f}, {0x0, 0x332}, {&(0x7f0000001500)="19", 0x1}], 0x6}, 0x0) 17:39:53 executing program 5: r0 = socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001a40)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000500)={0xa, 0x4e22, 0x0, @dev, 0xff}, 0x1c, 0x0}}], 0x2, 0x0) 17:39:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/33, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:53 executing program 2: r0 = creat(&(0x7f0000000340)='./file0\x00', 0x0) fsetxattr(r0, &(0x7f0000000180)=@known='user.syz\x00', 0x0, 0x0, 0x0) 17:39:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) madvise(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x4) [ 85.566268] binder: release 3959:3964 transaction 177 out, still active [ 85.578437] binder: undelivered TRANSACTION_COMPLETE [ 85.605520] binder: send failed reply for transaction 177, target dead 17:39:53 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x9, &(0x7f0000000000)=0x4, 0x4) 17:39:53 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$packet(0x11, 0x2, 0x300) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0x2, &(0x7f0000000000)=0x1d, 0x4) 17:39:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/169, 0x2aa}], 0x1, 0x0) [ 85.658936] binder: 3980:3985 got transaction with invalid data ptr [ 85.667697] binder: 3980:3985 transaction failed 29201/-14, size 32-0 line 3155 17:39:53 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4000000000002dd, 0x0) 17:39:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000000)) 17:39:53 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000100), 0x10) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000440)="3cc967b24fefb11a1c4cbef8cbb9c05e2f16a07d3d4854fd00c9bd339fd708cf872860ebef2402f81d4d458089d6200e3ab99870a20ec41feecd9a9bb28554db390eaa31d8448d7071d3cbee2c5350791aba8b11321cfc6b84da444ef5120c2065c5cf7146419274f7b73af28b832637dd6433cace18cb0651af9f6fd29295d36baacd462c1049a5fa7bd70503d678da66e752c8e70841ef217f", 0x9a}, {&(0x7f00000001c0)="3d3c84d18760e76310dc9873accf964b615a83ec83960f74ebbef6d066b3bfa797d8a06d5159cbca0f81cc1305db24448d566077572e10642c4af511732f3c7b25f4c337e580243c5477643e56abb39c5da375c3542742089f91b0a06c21935917cd0e6769b69738906d85306a0d92acc44de28709e66c6c6378a566927fd27530363f384188848fc1dd97c9b2ca3b76812653fb7f547d399e429a23fc560e4d6ab88b5790ce2efa1e33b504a6e788df03626cbdc88713cf48225f6547", 0xbd}, {&(0x7f0000000280)="5105fc0aeb147ab3bd2c12f746d272dc4245f7d236dd60b0c878e6f9ad137bb0", 0x20}, {&(0x7f00000002c0)="518f4ebb6a70a781d431d629f70cf18c11e00870ea18fa886970bfe245d05096eb575901b6d4dc04ee8b134586c79b764387fa7617fba43daa6a8a9360e2a85f08e3de8532ebab8b43b5c138699ff5fa2e0d2a9ea611c392de15edbed41c961d372486a250f0a1191f8f79f4a66d1d13abc2e104cf311d3b48ebfd7bd050c44ab65c1b67", 0x2e3}, {&(0x7f0000000380)="63660150476973f67807f0d3fba51fe83e1fed5f98151230582fe6151891b164bc0f6997b1d3c0eebda1089212", 0x2d}], 0x5, &(0x7f0000000740)=[@ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback, @multicast2}}}, @ip_tos_u8={{0x11}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}, @ip_retopts={{0x211, 0x0, 0x7, {[@ra={0x94, 0x6}, @rr={0x7, 0xb, 0x0, [@remote, @broadcast]}, @noop, @lsrr={0x83, 0x1f, 0x0, [@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @dev, @dev, @rand_addr, @loopback, @loopback]}, @ra={0x94, 0x6}, @generic={0x0, 0x11, "1cb8844225950b82dcf23d0402addb"}]}}}, @ip_tos_u8={{0x11}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @empty, @multicast2}}}], 0x108}, 0x0) 17:39:53 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 85.751248] binder: undelivered TRANSACTION_ERROR: 29201 17:39:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/33, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:53 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x82000, 0x0) close(r0) 17:39:53 executing program 2: rt_sigaction(0x13, &(0x7f0000000080)={0x0, {}, 0x0, 0x0}, 0x0, 0x8, &(0x7f0000000180)) 17:39:53 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000003b00)=[{{&(0x7f0000000300)={0xa, 0x4e24, 0x0, @empty}, 0x1c, 0x0}}, {{&(0x7f00000017c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1c, 0x0, 0x0, &(0x7f0000003040)=[@pktinfo={{0x24, 0x29, 0x32, {@ipv4={[], [], @loopback}}}}], 0x28}}], 0x2, 0x0) 17:39:53 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x0) [ 86.114945] binder: 4021:4022 ioctl c018620c 20000000 returned -22 [ 86.122755] binder: 4021:4023 ioctl c018620c 20000000 returned -1 17:39:53 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000)=')et\x02\x16\x00W\xca\xdad\x8dt0:loppp0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) dup2(r0, r3) fsetxattr$security_smack_transmute(r3, &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x0) 17:39:53 executing program 5: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) syz_open_dev$evdev(&(0x7f0000000380)='/dev/input/event#\x00', 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x20000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000c40)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6#\xd9\xa1W\x1c\xb96\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\x97\x80\xe9\xa1S\f\xc7?\xa6\x95I\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~\xff\xff\x00\x00#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xd5\x1b\xca\xa9\xc7[\xa2\xef\xacM\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xb4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\x04R\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xafh_\x9c\x91\xc1q_|L\x11\x03\x94\xc0\t=\x17\x95P\xd7\xcdH\x1c8^ARL\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x13\x82Rk\x9cAz\xab\rT\xadLO\f\x17Y\x1dg\x10\xe3LL\x1fC\xfa\xd9\xb0\xfb\xb4\xf3[\xdf\xd0\xd6\x82\xf6~0\xb8\xf4\xb0X\xfew\xbdY\n\xd6\x105\x9c\xb7\xe5F\xc1:9\xb8\xc2\x85\b\xfd\x92\xb0k\x93\xd7\xc40J\xc2\xf0=p\xd6\xe3\xe4W:\xd2\xf6\xfc\x83\xb1\xcb\xd1K\xb9(\"9(~\xf4\xf4\x94`\xe8\xdb\x17\xf9\xcf#)T\xcdj^\xa61\x12\x91 \xd7\x92\xc0\xd0s\xa9\xe4\x18:') r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000940), 0x0, 0x0, 0x0, 0x0) r2 = memfd_create(&(0x7f0000000000)=')et\x02\x16\x00W\xca\xdad\x8dt0:loppp0\x00', 0x0) write(r2, &(0x7f0000000280)='&', 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x3) dup2(r2, 0xffffffffffffffff) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f00000000c0)={0xffff, 0xfff, 0x1000, 0x19, 0x14, 0x7, 0x4f, 0x0, 0x3, 0xc9, 0x3f}) 17:39:53 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 17:39:53 executing program 3: socket$inet6(0xa, 0x4, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, 0x0, &(0x7f0000000280)='system_u:object_r:iptables_unit_file_t:s0\x00', 0x2a, 0x0) close(0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) [ 86.162570] binder: 4024:4025 got transaction with invalid data ptr [ 86.189966] binder: 4024:4025 transaction failed 29201/-14, size 32-0 line 3155 17:39:53 executing program 2: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001700)='/dev/rtc0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) creat(0x0, 0x0) io_setup(0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r2, 0x4, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x40000}]) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x100) r4 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r4, r3, 0x0) fcntl$setstatus(r3, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r5, 0x4, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000000000), 0x40000}]) ioctl$RTC_IRQP_READ(r0, 0x8008700b, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlock(&(0x7f0000704000/0x1000)=nil, 0x1000) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) munlockall() syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') [ 86.249143] binder: undelivered TRANSACTION_ERROR: 29201 17:39:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) dup2(r0, r1) 17:39:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x25, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/33, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:54 executing program 1: creat(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'vlan0\x00'}) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) prctl$PR_GET_SECUREBITS(0x1b) pipe(0x0) write$binfmt_elf64(r3, &(0x7f0000000380)=ANY=[], 0x84f0) write$binfmt_misc(r3, &(0x7f00000000c0)=ANY=[], 0x7fffffff) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) ioprio_get$uid(0x0, 0x0) sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) recvfrom(r4, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) 17:39:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r3, 0x0, 0x0) r4 = socket(0x1, 0x3, 0x0) r5 = eventfd(0x0) io_submit(r3, 0x2, &(0x7f0000000440)=[&(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x3, r5}, 0x0]) 17:39:54 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x1ee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)=0x0) io_submit(r2, 0x4, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x40000}]) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x100) r4 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r4, r3, 0x0) fcntl$setstatus(r3, 0x4, 0x44000) io_setup(0x40000000008, &(0x7f0000000240)) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlock(&(0x7f0000704000/0x1000)=nil, 0x1000) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) munlockall() syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') 17:39:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x26, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/34, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) [ 86.353485] binder: 4062:4063 got transaction with invalid data ptr [ 86.361320] binder: 4062:4063 transaction failed 29201/-14, size 32-0 line 3155 [ 86.380049] binder: undelivered TRANSACTION_ERROR: 29201 17:39:54 executing program 3: syz_open_procfs(0x0, &(0x7f0000000080)='net/ipv6_route\x00') pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setgid(0x0) write$P9_RGETATTR(r1, &(0x7f00000003c0)={0xa0, 0x19, 0x0, {0x0, {0x0, 0x0, 0x7}, 0x0, 0x0, 0x0, 0x154, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x7c71}}, 0xa0) socket$inet6(0xa, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) 17:39:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 86.468548] binder: 4078:4079 got transaction with invalid data ptr [ 86.475277] binder: 4078:4079 transaction failed 29201/-14, size 8192-0 line 3155 [ 86.489260] binder: undelivered TRANSACTION_ERROR: 29201 17:39:54 executing program 5: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) 17:39:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x26, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/34, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:54 executing program 0: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) [ 86.551256] binder: BINDER_SET_CONTEXT_MGR already set [ 86.568106] binder: 4086:4088 ioctl 40046207 0 returned -16 17:39:54 executing program 2: socket$inet6(0xa, 0x4, 0x0) fsetxattr$security_selinux(0xffffffffffffffff, 0x0, &(0x7f0000000280)='system_u:object_r:iptables_unit_file_t:s0\x00', 0x2a, 0x0) close(0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) 17:39:54 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) [ 86.619565] binder: 4092:4095 got transaction with invalid data ptr [ 86.652340] binder: 4092:4095 transaction failed 29201/-14, size 8192-0 line 3155 17:39:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x26, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1163484000"/34, @ANYPTR=&(0x7f00000000c0)=ANY=[]], 0x0, 0x0, 0x0}) 17:39:54 executing program 1: creat(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'vlan0\x00'}) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffb, 0x31, 0xffffffffffffffff, 0x0) prctl$PR_GET_SECUREBITS(0x1b) pipe(0x0) write$binfmt_elf64(r3, &(0x7f0000000380)=ANY=[], 0x84f0) write$binfmt_misc(r3, &(0x7f00000000c0)=ANY=[], 0x7fffffff) ioctl$sock_SIOCADDDLCI(0xffffffffffffffff, 0x8980, 0x0) ioprio_get$uid(0x0, 0x0) sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) recvfrom(r4, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) [ 86.687875] binder: undelivered TRANSACTION_ERROR: 29201 17:39:54 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) sendmsg$sock(r0, &(0x7f0000001140)={0x0, 0x0, 0x0}, 0x0) [ 86.773391] binder: 4116:4118 got transaction with invalid data ptr [ 86.790377] binder: 4116:4118 transaction failed 29201/-14, size 8192-0 line 3155 [ 86.803080] binder: undelivered TRANSACTION_ERROR: 29201 17:39:54 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 17:39:54 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) 17:39:54 executing program 3: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffc61) recvmsg(r0, &(0x7f0000000140)={0x0, 0x100000039, &(0x7f0000000000)=[{&(0x7f0000000380)=""/110, 0xffffffd9}], 0x1, 0x0, 0x4a}, 0x2f04) 17:39:54 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0b038aa174030a00e08f93dd86dd20686d3c65005901491ede4a165d0123fbf93daa5b64e1e01b3aa06961072108510101000000000000486ef9951ddae84aeba911844f539e9be7e5dc620000000000000c46f44ab705b82ba8951665fdca3ce999d71e01af966b1af213e2fb1eb084a72c3e3ae46edbd660584d1c50daea9654e335f0b752175c53b8e1e6f2c62f4ddb8aa3964a243263eb3ba1d47950f196e500"/175], 0xfdef) 17:39:54 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000003c0), 0x4) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[@ANYRESOCT=0x0, @ANYRES16=0x0], 0xfeec) recvmsg(r0, &(0x7f0000001440)={0x0, 0xa, &(0x7f00000015c0)=[{&(0x7f0000001600)=""/4096, 0xf99e}], 0x1, 0x0, 0xff96ce4aaaa47475, 0x7115}, 0x0) 17:39:54 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4000000000002dd, 0x0) 17:39:54 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\x00', 0x43732e5398416f1a}) close(r0) 17:39:54 executing program 5: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) [ 87.034365] skbuff: bad partial csum: csum=10/36832 len=3712 17:39:54 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000080)={[{0x0, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd'}]}, 0x2000fe6f) [ 87.157783] skbuff: bad partial csum: csum=10/36832 len=3712 17:39:54 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00'/15], 0xfdef) 17:39:54 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00'/10], 0xa) [ 87.296369] ================================================================== [ 87.303799] BUG: KASAN: stack-out-of-bounds in iov_iter_advance+0x4b3/0x4f0 [ 87.310911] Read of size 8 at addr ffff8801cf0bfce8 by task syz-executor.1/4169 [ 87.318353] [ 87.319983] CPU: 1 PID: 4169 Comm: syz-executor.1 Not tainted 4.4.174+ #17 [ 87.326989] 0000000000000000 6767e0d0e4540fdb ffff8801cf0bf998 ffffffff81aad1a1 [ 87.335055] 0000000000000000 ffffea00073c2fc0 ffff8801cf0bfce8 0000000000000008 [ 87.343111] ffff8801cf0bfce0 ffff8801cf0bf9d0 ffffffff81490120 0000000000000000 [ 87.351257] Call Trace: [ 87.355845] [] dump_stack+0xc1/0x120 [ 87.361209] [] print_address_description+0x6f/0x21b [ 87.367872] [] kasan_report.cold+0x8c/0x2be [ 87.373850] [] ? iov_iter_advance+0x4b3/0x4f0 [ 87.380077] [] __asan_report_load8_noabort+0x14/0x20 [ 87.386847] [] iov_iter_advance+0x4b3/0x4f0 [ 87.392818] [] tun_get_user+0x2c6/0x2640 [ 87.398546] [] ? tun_free_netdev+0xb0/0xb0 [ 87.404435] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 87.411191] [] ? check_preemption_disabled+0x3c/0x200 [ 87.418029] [] ? check_preemption_disabled+0x3c/0x200 [ 87.424868] [] ? __tun_get+0x126/0x230 [ 87.430403] [] tun_chr_write_iter+0xda/0x190 [ 87.436453] [] __vfs_write+0x2e8/0x3d0 [ 87.442007] [] ? __vfs_read+0x3c0/0x3c0 [ 87.447625] [] ? check_preemption_disabled+0x3c/0x200 [ 87.454464] [] ? selinux_file_permission+0x2f5/0x450 [ 87.461210] [] ? rw_verify_area+0x103/0x2f0 [ 87.467180] [] vfs_write+0x182/0x4e0 [ 87.472568] [] SyS_write+0xdc/0x1c0 [ 87.477858] [] ? SyS_read+0x1c0/0x1c0 [ 87.483317] [] ? do_fast_syscall_32+0xd6/0xa90 [ 87.489549] [] ? SyS_read+0x1c0/0x1c0 [ 87.495000] [] do_fast_syscall_32+0x32d/0xa90 [ 87.501148] [] sysenter_flags_fixed+0xd/0x1a [ 87.507194] [ 87.508813] The buggy address belongs to the page: [ 87.513738] page:ffffea00073c2fc0 count:0 mapcount:0 mapping: (null) index:0x0 [ 87.521937] flags: 0x4000000000000000() [ 87.526053] page dumped because: kasan: bad access detected [ 87.531781] [ 87.533386] Memory state around the buggy address: [ 87.538293] ffff8801cf0bfb80: 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 f3 f3 f3 [ 87.545631] ffff8801cf0bfc00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 87.553009] >ffff8801cf0bfc80: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2 00 00 [ 87.560345] ^ [ 87.567128] ffff8801cf0bfd00: 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 f3 f3 f3 [ 87.574462] ffff8801cf0bfd80: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 87.581882] ================================================================== [ 87.589219] Disabling lock debugging due to kernel taint [ 87.599037] Kernel panic - not syncing: panic_on_warn set ... [ 87.599037] [ 87.606441] CPU: 1 PID: 4169 Comm: syz-executor.1 Tainted: G B 4.4.174+ #17 [ 87.614657] 0000000000000000 6767e0d0e4540fdb ffff8801cf0bf8d8 ffffffff81aad1a1 [ 87.622765] ffff8801cf0bf9e8 ffffffff82c5cf1b ffff8801cf0bfce8 0000000000000008 [ 87.630773] ffff8801cf0bfce0 ffff8801cf0bf9b8 ffffffff813a48c2 0000000041b58ab3 [ 87.638796] Call Trace: [ 87.641366] [] dump_stack+0xc1/0x120 [ 87.646710] [] panic+0x1b9/0x37b [ 87.651706] [] ? add_taint.cold+0x16/0x16 [ 87.657485] [] ? preempt_schedule+0x24/0x30 [ 87.663436] [] ? ___preempt_schedule+0x12/0x14 [ 87.669655] [] kasan_end_report+0x47/0x4f [ 87.675432] [] kasan_report.cold+0xa9/0x2be [ 87.681382] [] ? iov_iter_advance+0x4b3/0x4f0 [ 87.687506] [] __asan_report_load8_noabort+0x14/0x20 [ 87.694238] [] iov_iter_advance+0x4b3/0x4f0 [ 87.700187] [] tun_get_user+0x2c6/0x2640 [ 87.706136] [] ? tun_free_netdev+0xb0/0xb0 [ 87.712004] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 87.718736] [] ? check_preemption_disabled+0x3c/0x200 [ 87.725557] [] ? check_preemption_disabled+0x3c/0x200 [ 87.732375] [] ? __tun_get+0x126/0x230 [ 87.737896] [] tun_chr_write_iter+0xda/0x190 [ 87.743936] [] __vfs_write+0x2e8/0x3d0 [ 87.749452] [] ? __vfs_read+0x3c0/0x3c0 [ 87.755055] [] ? check_preemption_disabled+0x3c/0x200 [ 87.761876] [] ? selinux_file_permission+0x2f5/0x450 [ 87.768611] [] ? rw_verify_area+0x103/0x2f0 [ 87.774561] [] vfs_write+0x182/0x4e0 [ 87.779905] [] SyS_write+0xdc/0x1c0 [ 87.785159] [] ? SyS_read+0x1c0/0x1c0 [ 87.790591] [] ? do_fast_syscall_32+0xd6/0xa90 [ 87.796803] [] ? SyS_read+0x1c0/0x1c0 [ 87.802261] [] do_fast_syscall_32+0x32d/0xa90 [ 87.808396] [] sysenter_flags_fixed+0xd/0x1a [ 87.815020] Kernel Offset: disabled [ 87.818632] Rebooting in 86400 seconds..