fd59d2db7ad7b2a26bcba9872983f6fb4a62506bc7a907acd3a412cdfa41a46e797af66f7718ad7d65efb45b8dc9c60376bb589d4e4172f2187556d8d24f54f1340b54af304406ee3f9bada57fe3925d6ca02891c8c5cf837adde9b4f4e73f547fea90c336b030a674361f4897f2156399c62d71ee54ae9e47e1d441b910e2a459074ef57b6066d09866ea6cd3e5bec5190d774715a57f553e912d7b99a99b70137695de83a28ba78d2f30fb4a3bd24834abc78f39f0213eb463295b18001c6636bfe3fe5fa4dc49404984d1b71f878bd7badcfac844c6cb2ed39619b340520351d076fed5fb4cfdab318219ecf7e27289701037570b763d7cdb2e9a2dc3beb747bc405552f63e86d19cfe6a1fdc4dfcb1a67ae20805800c5c9a08630315a5b7a5fa9f2267eb3321e4ce0a059fe44cc184d49f123fe9129f8abd5c68c5fa826fafa105cd95b9fc9189adf39a97e110c70b29ca121d7d8198f95259affaae14ef1ccadc5c879a75dc4ae27d90a939dc2fc1d1e9847629082e391409c99c090244431668d1fcbd143a22ee7d4f93276f16eb689741318293cd963d2855998c849fe2b92bf771870219bf0e7766ca553f23e0204ecc1b8ea4e38ede9dc8284a70d8bb65ad57086975579e2fcf946d6cf2526e9c495b9131d288807e914236d5d3a6d585a9f013f3ca7284407c4fff0beb84b9b23a73bdb8db52acf48645e42e844e63d94e7d75e259f4c2ca84a1cb46212c8971b2d45ab035faae8f60f7988a1214008edbb9b536ebfaff9bf4e9a52e348736373d40ab5b34943ece9ce24b31057a4da21b382815bc007664407dad1469da2c5b141da5ed8a24950f818f859c891e10edf544f9d02fed54a2d97333f1a95f517d2694059f4749805da067d25d9855aac83150ad13a66e0ded7f9783620c790f9ba3b7137fbf2caf89c74f9ee82893124007c7953860d35933e2a8392bd9f1300b4af4cd311a8ce798b37c5df9b9af0e80e3857c5c351919ae1725ba4dae1a9ed8e79bbbb6f7cd39626188a550014b69bd91b4cc08026aef7adb7527f59aecb45cccbf959348f913a1bc05f99a8bfefb4f90ce2639506881edffc071c666c8ea3b58886d97110e57ec15acb1d7bc57dc6d70127927097634336118172015f9cedd7993fe8bf21ace85a5b839f7319657ad36133be848dfd5c0e879ea3db38efa5de972339e4338eba4fe6e415bdbb1967ca07703e4746bc19369915bd3994ab49bc00d4a89ec7c776d05ec98d9a94f59e09f9e8f48b12c178a63404c2f1f2d3a39ea7149cfb3312b5a56358215c1bc2a05693971100138daa3245f30afaf23ccec62154516d16a25b2e3dd465e1ae6bc0c67d29f330d557f65396ca63a297b80f80569be747a6e3d2377b32ecc81f12107aad448cfe12aaba6a1f4b00466fca3f10ec3375fc5a8a807c074f1bc857d95e0543e46a7ad07f79b08866b28be6c1f4a1bac4cdb2cef471fa6280af29f123e978260e1e2feaf3e17807309a42a2af425c901444bbf89e4d57597edead6fb7f68dd9d97c90e866b4ad5a4b4157beb588220e3cc174af5d45c06dc987e7c176838db6f548d9305f36056b9b4628855335940fb2749df12fb229b022b7de7a9c9804575343674ec187c46ab0add60df7687213ae9b3dcfffab47cae7151996ccf5572028705c039957bd7f349fbeffe074e130f16fb44a6386c22a9fbc9cdc001b2316bf56504261d0f3627ceefbd6c63e2906d61d68c9db32fdd0bba4e8fc443c248b28d54e2785baccafb253b35919cc4bece5407fc90a462f630ecd8a7894cbbc8940ba8332eec9ab009a0dbadb588e0e5117f612494a0bb07668024d7cced02cf87f871e4469d5e356065b90d3deb16233e17e9a028119fa025c31aff83d885da851956b6af04c04a9d9d78d78b584c286320e0b212282750cf3f4014773ae940572d2c7fccd3c41c78930f376652c0c138f6659beaf2091d189160ca64c2a36bca2220b013465c3aa2223167a6874324440136414371be2480a23c63b88cbc9a5d233293a2b0e32e56ec24e083cab8c7a5a0da4ebbee93da195f25ad867ab7b526f38b670639a20d8e7d9504725bc1cf7bf5d1e18b9312ebdf01783f075cf3811fa622f2a4281660292ad96bca0e2e33927230860dd2a1d24d00f6e76f96f60e2fde5530d733d8c236e08bfc6465aec10dbadd1258e1c077f667bbc269b1f0b374448cb693f9da27bd90a9a058b4f27c7e0c62e0216a0511643cf7aa2e4595ea7c0df9045bdeb394503a2a07a384d75911e4ef0f6eb6c5454c5a12f67d6bac8a7f0adde8b9ad30adbbe7edac33b146859d225a0bb6dc89fc176b322165fde521a31be514ca02728c16bccb8bbe8a8bb4b015d1baa4e8cbf4189d093cd71f54e0bc1d0fbcbc8e4762e8962e27cc4abda066646e28680eb7bfc6d5684c48cc96182c3333e0322c354d9e8bd77ae0dfcba2dc60c2ae5228d4b428fc653ede02a14703b26abe09f7e9cde6ac6247b59e7e3e6ad38312fd58a4c4d17ac4462b2f7020baa8426a2b79aa952c48f0f4feadba05252b230b79336672cdf0ae5c0e26a71ab672bf032f5827f846e61528265c525e254ad11a79b3c6d5e1fc207de41b0da4f9c2eedb3bce34f0469f728946e2f4644e73fa99b8ced4f47138e1a3445f4d7b54ca181debf966dee617f7c88f5e50cdf9d03f628964b4973dd0bfba993680ce8e1f1690991501ea51d068701c8c2113498cbc1d2669b2a84f21ac4f64446500de16dc70bf75335981916484852337c8119ccf21e4d3df069228aaa552a59b04cd82e42afc3c1b3052c61cce9f198dcf1e91cf2ed24b395deeff564c4d943b85c50d20e5f4ae5386d66a641bb62136f5483a03be2fb82c6a7023102ac46238db51ad6725c3d076fba1065b5800d3e725c194e6fe58bf53c3e451f6776fa652d108b08229452b30f4f0530520a7dff6230098643aa64243f6f9bf252c7529dd7204484d75429013e000bb57ea8c024e90273a58fcbddda072013d86d2204cf1244293b4c1dd81810be50d355618f3205b2631dc60ffac616d36a1da518a7011c5127696d36c638c7237d781086f8bb2fecae0ff380a9e267627598a96b5a276ad21429117fbe9fe02e279395fd43b9d76f5bd163b2784ba8fb39497e1f021adb6d2ef8578cf15719afe8fd4de56993b2837278e9b077628329b94e782cc744b30eaf3a6892154c7400aaa8b04c6c948fbaba6b7d5deb0927c13ef974b2b1b01e30257f6b03c672b05009e4adc6572029f4fcfc5df248b904dd11952a424a6fc13590575191a8e0cf25fcbccd7572b493f41db5ee44219df69f16581e333592709d57b466e3280103a935bf6dabae3584845875b4acde764f56ad4f1831a0c33094869a474766862dcbb0222757fda42164f65af2e0533f44f0c9359338cb00de6dde5450bc92794b8434bda00bdecde371fe391108723496e6e585565236d30acc1b9cc2b063f9e6d0599d2c189ba06b5211bdc49d6c0ee7f3bc42c7daf21a6f2310dcaf2348e53a097ab5d173050ffa78702521eed83bcaf7bae3a6e14e757b9474dc827a019608a030414f40efd9784cda710dce2d3fd1671b6f9ef592bda17028817774b021a141d88741c6e62d3238fd179db841b7dcd3dab439d720086c02223fac20b4fbbe303edd7f1bda2760aa51824576443dbebf1a6080a6b82b11e3c62b15382a590b5c4557148146a4e6f33d92966266efa805db386cb3cf3ceb9e5bcbd2f1b44e3160bb62d0266f12204ae2f57fd33da3c572ea189821bd2bb5ac6d18ee4593628f49211b4010372d31e7f321feb5e0d1e9e6778784f2a8b5ed27f6d58d3a0ab135a29c642d177720d57e71aa689f8b6b1afaa9c6c030e7ade5958e5eda9cb57dcc37c612a3570cf7cdd341d7ecaaea5eb9a52720ce7874216021e2dd5be7269f5f486fcb6a9f9c7d622aa3685c2c5d68f87d39daadaa675aac8c75ebf0cb6e0e6ef9fab06ce2ae6a2cfd418b34efc0581cdb8a56a644e1c19a603155a48f105a66c5d02899a36bd28bdf7a0bf023833725787fb60a47608e3510e5ba145ac3b93e6867cbaded3b47e6cb4f43880042521b4955b909c63265d50c72a8965dd4163fb2ea88fec4d3f930e89ab8be1aaab82b42f5e6a51a953147b0a1348728b30cc8c12fb88d0bd6501fd2615b5d0fe28901a5a2404f76a2a7cb889b590527b6e37b1fa6e43333282c3a469daa826bb05a07e2f1b595cddba8b45c19b9f1ce26b837ca1c", 0x1000}, {&(0x7f0000001a00)="3e2edcfa6e966d5a4a6f58ea64ab2792937e2435e3ee62c82bac4557935f5bf3e6ce1bbd8645cec51da173a74a7dc66519c0254339521b65f2484bd2acbe4a39885dda55012b3bc28b5efd1d8d3cd9f1af7cd5fb6297915bc9ab53db3a0b8652437ccadb5121a97709e719e66700bbfd85f1ba8bd856b9cff6fa20d8da0f81f289", 0x81, 0x2}, {&(0x7f0000001ac0)="4cc6b83822e493f3d09780f0f464", 0xe, 0x3}, {&(0x7f0000001b00)="24601ecc40fb522846d9721669e9692074027f41f6db9832e7aacc6671cbe321b05e4636e734e5fd76948869ede647fcb7c1951b899b081a32bb6b165ee956571297026f14ca9611709b36b9e1bac345c2dc05e0fbf29752988c2f71eb2a22e2b5f2dbe98ab4", 0x66}]}, 0x4, 0x3}, 0x1) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x1b0, 0x0, &(0x7f0000000800)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/229, 0xe5, 0x0, 0x2d}, @flat=@weak_handle={0x77682a85, 0x100a, 0x1}, @flat=@binder={0x73622a85, 0x1001, 0x3}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1400}, @request_death={0x400c630e, 0x3}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/130, 0x82, 0x0, 0x22}, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/79, 0x4f, 0x1, 0x34}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000003c0)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000400)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r0, @ANYBLOB="2df180505f2200000000000000000000000085616466000000000300000020c51b3d3372389c000000000900000000000010000000000000"], &(0x7f0000000480)={0x0, 0x18, 0x38}}}, @clear_death={0x400c630f, 0x3}, @increfs={0x40046304, 0x2}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000500)={@flat=@binder={0x73622a85, 0xa, 0x1}, @fda={0x66646185, 0x0, 0x0, 0x5}, @flat=@binder={0x73622a85, 0x1, 0x3}}, &(0x7f0000000580)={0x0, 0x18, 0x38}}, 0x1000}, @transaction_sg={0x40486311, {0xfffffc00, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000740)={@fda={0x66646185, 0x3, 0x2, 0xb}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/164, 0xa4, 0x2, 0x1c}, @ptr={0x70742a85, 0x0, &(0x7f0000000680)=""/182, 0xb6, 0x1, 0x21}}, &(0x7f00000007c0)={0x0, 0x20, 0x48}}, 0x40}, @acquire={0x40046305, 0x2}, @release={0x40046306, 0x1}, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:30 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:30 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406325, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:30 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = syz_open_dev$rtc(&(0x7f0000000000), 0x0, 0x2a000) ioctl$RTC_WIE_ON(r1, 0x700f) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) [ 1779.005462][T25641] binder: 25633:25641 ioctl 401c5820 20000000 returned -22 [ 1779.012819][T25640] binder: 25631:25640 ioctl 40086602 20000000 returned -22 [ 1779.015454][T25643] binder: 25639:25643 ioctl 401c5820 20000000 returned -22 10:17:30 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250, 0xfa}, @fda}, &(0x7f00000000c0)={0x0, 0x20, 0x48}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:30 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x48c02, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0xc0406618, &(0x7f0000000040)={@desc={0x1, 0x0, @desc2}}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="000000f853b338493cfa22874d7182bb751861a744c0cebf7c0352e30b199660145810cfb05626a26ff2860ab4894daff9d77082d84f269205247722afc530008baf8983d0984d5234c9dd96a2e58d3713994b226b446a4d829c1e324be8e0b15858da73e30925e883919a381624dc3be78788b3dc8adc0277462bff4ae1be99bb406c7077f73e74a3abf7f225ac2842a1", @ANYRES16=r2, @ANYRES8=r2, @ANYRES32=0x0, @ANYRESDEC=r2, @ANYRES8=r2, @ANYRES64=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYBLOB="d4d6aa8af8ca328a8ecfed0dc0054b7813b445aab32f0df8d702496e178785ed0fa41282f69689ff34812de41f7dd8eea88d0aeafa5412423fa81c94ceea19f1ea0db76d4c16e949403ec030a786c518ef639f76d2736b21057526048f64741e000dfca6f6983ba7d45fc2ab3fda1b71a7f72ef9b07e06277a87e2d91a147d8db04c52f0", @ANYRES64=r2, @ANYRES8=r0, @ANYRES8=r2], 0x50}, 0x1, 0x0, 0x0, 0x24040000}, 0x40) symlinkat(&(0x7f0000000080)='./file0\x00', r1, &(0x7f00000000c0)='./file0\x00') 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40402300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = syz_open_dev$rtc(&(0x7f0000000000), 0x0, 0x2a000) ioctl$RTC_WIE_ON(r1, 0x700f) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x48c02, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0xc0406618, &(0x7f0000000040)={@desc={0x1, 0x0, @desc2}}) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="000000f853b338493cfa22874d7182bb751861a744c0cebf7c0352e30b199660145810cfb05626a26ff2860ab4894daff9d77082d84f269205247722afc530008baf8983d0984d5234c9dd96a2e58d3713994b226b446a4d829c1e324be8e0b15858da73e30925e883919a381624dc3be78788b3dc8adc0277462bff4ae1be99bb406c7077f73e74a3abf7f225ac2842a1", @ANYRES16=r2, @ANYRES8=r2, @ANYRES32=0x0, @ANYRESDEC=r2, @ANYRES8=r2, @ANYRES64=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYBLOB="d4d6aa8af8ca328a8ecfed0dc0054b7813b445aab32f0df8d702496e178785ed0fa41282f69689ff34812de41f7dd8eea88d0aeafa5412423fa81c94ceea19f1ea0db76d4c16e949403ec030a786c518ef639f76d2736b21057526048f64741e000dfca6f6983ba7d45fc2ab3fda1b71a7f72ef9b07e06277a87e2d91a147d8db04c52f0", @ANYRES64=r2, @ANYRES8=r0, @ANYRES8=r2], 0x50}, 0x1, 0x0, 0x0, 0x24040000}, 0x40) (async) symlinkat(&(0x7f0000000080)='./file0\x00', r1, &(0x7f00000000c0)='./file0\x00') 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406348, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1779.051627][T25656] binder: 25652:25656 ioctl 401c5820 20000000 returned -22 [ 1779.068227][T25665] binder: 25658:25665 ioctl 401c5820 20000000 returned -22 [ 1779.076248][T25668] binder: 25667:25668 ioctl c018620c 20000000 returned -22 [ 1779.090133][T25671] binder: 25670:25671 ioctl 401c5820 20000000 returned -22 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x48c02, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0xc0406618, &(0x7f0000000040)={@desc={0x1, 0x0, @desc2}}) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="000000f853b338493cfa22874d7182bb751861a744c0cebf7c0352e30b199660145810cfb05626a26ff2860ab4894daff9d77082d84f269205247722afc530008baf8983d0984d5234c9dd96a2e58d3713994b226b446a4d829c1e324be8e0b15858da73e30925e883919a381624dc3be78788b3dc8adc0277462bff4ae1be99bb406c7077f73e74a3abf7f225ac2842a1", @ANYRES16=r2, @ANYRES8=r2, @ANYRES32=0x0, @ANYRESDEC=r2, @ANYRES8=r2, @ANYRES64=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYBLOB="d4d6aa8af8ca328a8ecfed0dc0054b7813b445aab32f0df8d702496e178785ed0fa41282f69689ff34812de41f7dd8eea88d0aeafa5412423fa81c94ceea19f1ea0db76d4c16e949403ec030a786c518ef639f76d2736b21057526048f64741e000dfca6f6983ba7d45fc2ab3fda1b71a7f72ef9b07e06277a87e2d91a147d8db04c52f0", @ANYRES64=r2, @ANYRES8=r0, @ANYRES8=r2], 0x50}, 0x1, 0x0, 0x0, 0x24040000}, 0x40) (async) symlinkat(&(0x7f0000000080)='./file0\x00', r1, &(0x7f00000000c0)='./file0\x00') 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x4040634c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40402500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) socket$pppl2tp(0x18, 0x1, 0x1) r3 = gettid() capset(&(0x7f0000000340)={0x20071026, r3}, &(0x7f0000000380)={0x3, 0x3, 0x6, 0x6, 0x7ff, 0xf46}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r2, 0x8, 0x8000, 0x5, 0x6, {{0x23, 0x4, 0x2, 0x12, 0x8c, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @loopback, {[@timestamp={0x44, 0xc, 0x5e, 0x0, 0x6, [0x7, 0x57]}, @ssrr={0x89, 0x17, 0x1f, [@rand_addr=0x64010101, @loopback, @loopback, @loopback, @empty]}, @noop, @timestamp={0x44, 0x4, 0xd2, 0x0, 0x5}, @end, @timestamp_prespec={0x44, 0x24, 0xf1, 0x3, 0xa, [{@private=0xa010102, 0x80}, {@empty, 0x5}, {@broadcast}, {@broadcast, 0x7}]}, @rr={0x7, 0xb, 0x57, [@private=0xa010101, @multicast2]}, @rr={0x7, 0x1f, 0xfe, [@rand_addr=0x64010100, @remote, @multicast1, @empty, @private=0xa010101, @local, @loopback]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl2\x00', r4, 0x1, 0x10, 0xd8, 0x2, {{0x39, 0x4, 0x1, 0x6, 0xe4, 0x67, 0x0, 0x7, 0x29, 0x0, @local, @private=0xa010101, {[@noop, @timestamp_addr={0x44, 0xc, 0x59, 0x1, 0x8, [{@local, 0x1ff}]}, @timestamp_addr={0x44, 0x1c, 0xf9, 0x1, 0x1, [{@multicast2, 0x1}, {@local, 0x3ff}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x7}]}, @timestamp_prespec={0x44, 0x14, 0xae, 0x3, 0xa, [{@multicast2}, {@broadcast, 0x80000001}]}, @noop, @ssrr={0x89, 0xf, 0xce, [@multicast2, @remote, @multicast1]}, @end, @timestamp_addr={0x44, 0x4c, 0x9a, 0x1, 0x7, [{@multicast2, 0x3}, {@remote, 0xfffffffd}, {@rand_addr=0x64010102}, {@multicast1, 0x8a7}, {@loopback, 0x4}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x7}, {@rand_addr=0x64010100, 0x8001}, {@rand_addr=0x64010101, 0x1000}, {@broadcast, 0x8}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x30, 0xffffffffffffffff, [{0x0, 0x7, "0f13ae2c6d"}, {0x0, 0x6, "48ed4774"}, {0x0, 0x6, "52fc9e6d"}, {0x6, 0x7, "2abbb760e6"}, {0x1, 0x10, "477da6a076e13f658aec33d14f0f"}]}]}}}}}) [ 1779.099772][T25673] binder: 25672:25673 ioctl 401c5820 20000000 returned -22 [ 1779.119735][T25675] binder: 25664:25675 ioctl 40086602 20000000 returned -22 [ 1779.138190][T25686] binder: 25684:25686 ioctl 401c5820 20000000 returned -22 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xcc, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406368, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) socket$pppl2tp(0x18, 0x1, 0x1) r3 = gettid() capset(&(0x7f0000000340)={0x20071026, r3}, &(0x7f0000000380)={0x3, 0x3, 0x6, 0x6, 0x7ff, 0xf46}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r2, 0x8, 0x8000, 0x5, 0x6, {{0x23, 0x4, 0x2, 0x12, 0x8c, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @loopback, {[@timestamp={0x44, 0xc, 0x5e, 0x0, 0x6, [0x7, 0x57]}, @ssrr={0x89, 0x17, 0x1f, [@rand_addr=0x64010101, @loopback, @loopback, @loopback, @empty]}, @noop, @timestamp={0x44, 0x4, 0xd2, 0x0, 0x5}, @end, @timestamp_prespec={0x44, 0x24, 0xf1, 0x3, 0xa, [{@private=0xa010102, 0x80}, {@empty, 0x5}, {@broadcast}, {@broadcast, 0x7}]}, @rr={0x7, 0xb, 0x57, [@private=0xa010101, @multicast2]}, @rr={0x7, 0x1f, 0xfe, [@rand_addr=0x64010100, @remote, @multicast1, @empty, @private=0xa010101, @local, @loopback]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl2\x00', r4, 0x1, 0x10, 0xd8, 0x2, {{0x39, 0x4, 0x1, 0x6, 0xe4, 0x67, 0x0, 0x7, 0x29, 0x0, @local, @private=0xa010101, {[@noop, @timestamp_addr={0x44, 0xc, 0x59, 0x1, 0x8, [{@local, 0x1ff}]}, @timestamp_addr={0x44, 0x1c, 0xf9, 0x1, 0x1, [{@multicast2, 0x1}, {@local, 0x3ff}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x7}]}, @timestamp_prespec={0x44, 0x14, 0xae, 0x3, 0xa, [{@multicast2}, {@broadcast, 0x80000001}]}, @noop, @ssrr={0x89, 0xf, 0xce, [@multicast2, @remote, @multicast1]}, @end, @timestamp_addr={0x44, 0x4c, 0x9a, 0x1, 0x7, [{@multicast2, 0x3}, {@remote, 0xfffffffd}, {@rand_addr=0x64010102}, {@multicast1, 0x8a7}, {@loopback, 0x4}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x7}, {@rand_addr=0x64010100, 0x8001}, {@rand_addr=0x64010101, 0x1000}, {@broadcast, 0x8}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x30, 0xffffffffffffffff, [{0x0, 0x7, "0f13ae2c6d"}, {0x0, 0x6, "48ed4774"}, {0x0, 0x6, "52fc9e6d"}, {0x6, 0x7, "2abbb760e6"}, {0x1, 0x10, "477da6a076e13f658aec33d14f0f"}]}]}}}}}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x2, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40402a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1779.145434][T25690] binder: 25689:25690 ioctl 401c5820 20000000 returned -22 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x2000) r2 = getpgid(0x0) r3 = io_uring_setup(0x154b, &(0x7f0000000440)={0x0, 0x5bfc, 0x0, 0x0, 0x32a}) io_uring_enter(r3, 0x104b, 0xd876, 0x16, &(0x7f0000000500)={[0x7]}, 0x8) r4 = getpgid(r2) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={'\x00', 0xfa2, 0x0, 0x403, 0x3, 0x4, r4}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7fffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/221, 0xdd, 0x1, 0x3}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/225, 0xe1, 0x2, 0x15}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_FILES2(r3, 0xd, &(0x7f0000001900)={0x7, 0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000540)=""/52, 0x34}, {&(0x7f0000000580)=""/6, 0x6}, {&(0x7f00000018c0)=""/32, 0x20}, {&(0x7f0000000600)=""/73, 0x49}, {&(0x7f0000000680)=""/152, 0x98}, {&(0x7f0000000740)=""/240, 0xf0}, {&(0x7f0000000840)=""/4096, 0x1000}], &(0x7f00000018c0)}, 0x20) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xcc, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x4040636c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40402b00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1779.176513][T25700] binder: 25698:25700 ioctl 401c5820 20000000 returned -22 [ 1779.183432][T25703] binder: 25701:25703 ioctl 40086602 20000000 returned -22 [ 1779.191902][T25704] binder: 25702:25704 ioctl 401c5820 20000000 returned -22 [ 1779.197745][T25706] binder: 25705:25706 ioctl 401c5820 200004c0 returned -22 [ 1779.214466][T25708] binder: 25707:25708 ioctl 40086602 20000000 returned -22 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x3, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406374, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) (rerun: 32) socket$pppl2tp(0x18, 0x1, 0x1) (async, rerun: 64) r3 = gettid() (rerun: 64) capset(&(0x7f0000000340)={0x20071026, r3}, &(0x7f0000000380)={0x3, 0x3, 0x6, 0x6, 0x7ff, 0xf46}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r2, 0x8, 0x8000, 0x5, 0x6, {{0x23, 0x4, 0x2, 0x12, 0x8c, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @loopback, {[@timestamp={0x44, 0xc, 0x5e, 0x0, 0x6, [0x7, 0x57]}, @ssrr={0x89, 0x17, 0x1f, [@rand_addr=0x64010101, @loopback, @loopback, @loopback, @empty]}, @noop, @timestamp={0x44, 0x4, 0xd2, 0x0, 0x5}, @end, @timestamp_prespec={0x44, 0x24, 0xf1, 0x3, 0xa, [{@private=0xa010102, 0x80}, {@empty, 0x5}, {@broadcast}, {@broadcast, 0x7}]}, @rr={0x7, 0xb, 0x57, [@private=0xa010101, @multicast2]}, @rr={0x7, 0x1f, 0xfe, [@rand_addr=0x64010100, @remote, @multicast1, @empty, @private=0xa010101, @local, @loopback]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl2\x00', r4, 0x1, 0x10, 0xd8, 0x2, {{0x39, 0x4, 0x1, 0x6, 0xe4, 0x67, 0x0, 0x7, 0x29, 0x0, @local, @private=0xa010101, {[@noop, @timestamp_addr={0x44, 0xc, 0x59, 0x1, 0x8, [{@local, 0x1ff}]}, @timestamp_addr={0x44, 0x1c, 0xf9, 0x1, 0x1, [{@multicast2, 0x1}, {@local, 0x3ff}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x7}]}, @timestamp_prespec={0x44, 0x14, 0xae, 0x3, 0xa, [{@multicast2}, {@broadcast, 0x80000001}]}, @noop, @ssrr={0x89, 0xf, 0xce, [@multicast2, @remote, @multicast1]}, @end, @timestamp_addr={0x44, 0x4c, 0x9a, 0x1, 0x7, [{@multicast2, 0x3}, {@remote, 0xfffffffd}, {@rand_addr=0x64010102}, {@multicast1, 0x8a7}, {@loopback, 0x4}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x7}, {@rand_addr=0x64010100, 0x8001}, {@rand_addr=0x64010101, 0x1000}, {@broadcast, 0x8}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x30, 0xffffffffffffffff, [{0x0, 0x7, "0f13ae2c6d"}, {0x0, 0x6, "48ed4774"}, {0x0, 0x6, "52fc9e6d"}, {0x6, 0x7, "2abbb760e6"}, {0x1, 0x10, "477da6a076e13f658aec33d14f0f"}]}]}}}}}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x2000) (async) r2 = getpgid(0x0) r3 = io_uring_setup(0x154b, &(0x7f0000000440)={0x0, 0x5bfc, 0x0, 0x0, 0x32a}) io_uring_enter(r3, 0x104b, 0xd876, 0x16, &(0x7f0000000500)={[0x7]}, 0x8) (async) r4 = getpgid(r2) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={'\x00', 0xfa2, 0x0, 0x403, 0x3, 0x4, r4}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7fffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/221, 0xdd, 0x1, 0x3}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/225, 0xe1, 0x2, 0x15}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_FILES2(r3, 0xd, &(0x7f0000001900)={0x7, 0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000540)=""/52, 0x34}, {&(0x7f0000000580)=""/6, 0x6}, {&(0x7f00000018c0)=""/32, 0x20}, {&(0x7f0000000600)=""/73, 0x49}, {&(0x7f0000000680)=""/152, 0x98}, {&(0x7f0000000740)=""/240, 0xf0}, {&(0x7f0000000840)=""/4096, 0x1000}], &(0x7f00000018c0)}, 0x20) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xcc, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) socket$nl_audit(0x10, 0x3, 0x9) [ 1779.218039][T25711] binder: 25710:25711 ioctl 40086602 20000000 returned -22 [ 1779.224831][T25712] binder: 25709:25712 ioctl 401c5820 20000000 returned -22 [ 1779.257385][T25718] binder: 25714:25718 ioctl 401c5820 20000000 returned -22 [ 1779.265985][T25716] binder: 25713:25716 ioctl 40086602 20000000 returned -22 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x80000000, 0x2000) (async) r2 = getpgid(0x0) r3 = io_uring_setup(0x154b, &(0x7f0000000440)={0x0, 0x5bfc, 0x0, 0x0, 0x32a}) io_uring_enter(r3, 0x104b, 0xd876, 0x16, &(0x7f0000000500)={[0x7]}, 0x8) r4 = getpgid(r2) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={'\x00', 0xfa2, 0x0, 0x403, 0x3, 0x4, r4}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7fffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/221, 0xdd, 0x1, 0x3}, @fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f00000002c0)=""/225, 0xe1, 0x2, 0x15}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) io_uring_register$IORING_REGISTER_FILES2(r3, 0xd, &(0x7f0000001900)={0x7, 0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000540)=""/52, 0x34}, {&(0x7f0000000580)=""/6, 0x6}, {&(0x7f00000018c0)=""/32, 0x20}, {&(0x7f0000000600)=""/73, 0x49}, {&(0x7f0000000680)=""/152, 0x98}, {&(0x7f0000000740)=""/240, 0xf0}, {&(0x7f0000000840)=""/4096, 0x1000}], &(0x7f00000018c0)}, 0x20) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40402d00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x5, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40402e00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x4040637a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) socket$nl_audit(0x10, 0x3, 0x9) [ 1779.278936][T25726] binder: 25715:25726 ioctl 401c5820 20000000 returned -22 [ 1779.285762][T25728] binder: 25727:25728 ioctl 40086602 20000000 returned -22 [ 1779.297165][T25730] binder: 25729:25730 ioctl 401c5820 20000000 returned -22 [ 1779.302246][T25734] binder: 25733:25734 ioctl 40086602 20000000 returned -22 [ 1779.313242][T25736] binder: 25731:25736 ioctl 401c5820 200004c0 returned -22 [ 1779.314022][T25737] binder: 25735:25737 ioctl 40086602 20000000 returned -22 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40403000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) (async) socket$nl_audit(0x10, 0x3, 0x9) 10:17:31 executing program 1: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x8cd42, 0x4) getdents(r0, &(0x7f0000000280)=""/4096, 0x1000) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f00000001c0)={0x0, 0x39, &(0x7f0000000180)="4f1cf8997995c33fcd24eda67ec96a96fff72f2076006d062277b173b1c558a385cc17cd43096f0bfb4211602fc060fe3d21ecababa2b7d97e"}) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x7800, 0x20, 0x7f, 0x7fffffff, {{0x21, 0x4, 0x0, 0x10, 0x84, 0x66, 0x0, 0x7, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x3b}, @local, {[@noop, @rr={0x7, 0x7, 0x34, [@local]}, @timestamp={0x44, 0x8, 0x93, 0x0, 0x7, [0x9]}, @cipso={0x86, 0x13, 0x1, [{0x0, 0xd, "0fd6873d72f328de8eb987"}]}, @noop, @ssrr={0x89, 0x13, 0x38, [@local, @broadcast, @private=0xa010101, @remote]}, @timestamp_prespec={0x44, 0x2c, 0xb4, 0x3, 0x0, [{@dev={0xac, 0x14, 0x14, 0x26}, 0x1}, {@empty}, {@multicast1, 0x9a7}, {@private=0xa010101, 0x1}, {@local, 0x2}]}, @timestamp_addr={0x44, 0xc, 0x33, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}]}]}}}}}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406400, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40404c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1779.345384][T25742] binder: 25740:25742 ioctl 401c5820 20000000 returned -22 [ 1779.354057][T25744] binder: 25741:25744 ioctl 401c5820 20000000 returned -22 [ 1779.365412][T25748] binder: 25745:25748 ioctl 40086602 20000000 returned -22 [ 1779.375059][T25751] binder: 25749:25751 ioctl 401c5820 20000000 returned -22 [ 1779.384672][T25756] binder: 25750:25756 ioctl 40086602 20000000 returned -22 10:17:31 executing program 1: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x8cd42, 0x4) getdents(r0, &(0x7f0000000280)=""/4096, 0x1000) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f00000001c0)={0x0, 0x39, &(0x7f0000000180)="4f1cf8997995c33fcd24eda67ec96a96fff72f2076006d062277b173b1c558a385cc17cd43096f0bfb4211602fc060fe3d21ecababa2b7d97e"}) (async) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x7800, 0x20, 0x7f, 0x7fffffff, {{0x21, 0x4, 0x0, 0x10, 0x84, 0x66, 0x0, 0x7, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x3b}, @local, {[@noop, @rr={0x7, 0x7, 0x34, [@local]}, @timestamp={0x44, 0x8, 0x93, 0x0, 0x7, [0x9]}, @cipso={0x86, 0x13, 0x1, [{0x0, 0xd, "0fd6873d72f328de8eb987"}]}, @noop, @ssrr={0x89, 0x13, 0x38, [@local, @broadcast, @private=0xa010101, @remote]}, @timestamp_prespec={0x44, 0x2c, 0xb4, 0x3, 0x0, [{@dev={0xac, 0x14, 0x14, 0x26}, 0x1}, {@empty}, {@multicast1, 0x9a7}, {@private=0xa010101, 0x1}, {@local, 0x2}]}, @timestamp_addr={0x44, 0xc, 0x33, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}]}]}}}}}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40405800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) socket$pppl2tp(0x18, 0x1, 0x1) r3 = gettid() capset(&(0x7f0000000340)={0x20071026, r3}, &(0x7f0000000380)={0x3, 0x3, 0x6, 0x6, 0x7ff, 0xf46}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r2, 0x8, 0x8000, 0x5, 0x6, {{0x23, 0x4, 0x2, 0x12, 0x8c, 0x64, 0x0, 0x1, 0x2f, 0x0, @broadcast, @loopback, {[@timestamp={0x44, 0xc, 0x5e, 0x0, 0x6, [0x7, 0x57]}, @ssrr={0x89, 0x17, 0x1f, [@rand_addr=0x64010101, @loopback, @loopback, @loopback, @empty]}, @noop, @timestamp={0x44, 0x4, 0xd2, 0x0, 0x5}, @end, @timestamp_prespec={0x44, 0x24, 0xf1, 0x3, 0xa, [{@private=0xa010102, 0x80}, {@empty, 0x5}, {@broadcast}, {@broadcast, 0x7}]}, @rr={0x7, 0xb, 0x57, [@private=0xa010101, @multicast2]}, @rr={0x7, 0x1f, 0xfe, [@rand_addr=0x64010100, @remote, @multicast1, @empty, @private=0xa010101, @local, @loopback]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000300)={'syztnl0\x00', &(0x7f00000001c0)={'syztnl2\x00', r4, 0x1, 0x10, 0xd8, 0x2, {{0x39, 0x4, 0x1, 0x6, 0xe4, 0x67, 0x0, 0x7, 0x29, 0x0, @local, @private=0xa010101, {[@noop, @timestamp_addr={0x44, 0xc, 0x59, 0x1, 0x8, [{@local, 0x1ff}]}, @timestamp_addr={0x44, 0x1c, 0xf9, 0x1, 0x1, [{@multicast2, 0x1}, {@local, 0x3ff}, {@dev={0xac, 0x14, 0x14, 0x2f}, 0x7}]}, @timestamp_prespec={0x44, 0x14, 0xae, 0x3, 0xa, [{@multicast2}, {@broadcast, 0x80000001}]}, @noop, @ssrr={0x89, 0xf, 0xce, [@multicast2, @remote, @multicast1]}, @end, @timestamp_addr={0x44, 0x4c, 0x9a, 0x1, 0x7, [{@multicast2, 0x3}, {@remote, 0xfffffffd}, {@rand_addr=0x64010102}, {@multicast1, 0x8a7}, {@loopback, 0x4}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x7}, {@rand_addr=0x64010100, 0x8001}, {@rand_addr=0x64010101, 0x1000}, {@broadcast, 0x8}]}, @ra={0x94, 0x4}, @cipso={0x86, 0x30, 0xffffffffffffffff, [{0x0, 0x7, "0f13ae2c6d"}, {0x0, 0x6, "48ed4774"}, {0x0, 0x6, "52fc9e6d"}, {0x6, 0x7, "2abbb760e6"}, {0x1, 0x10, "477da6a076e13f658aec33d14f0f"}]}]}}}}}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/custom0\x00', 0x800, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x29, 0x9b, 0x6, 0x7, 0xc, @mcast1, @private1, 0x80, 0x40, 0xfffffff7, 0x9}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r7, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000380)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000440)={'syztnl1\x00', &(0x7f00000003c0)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x40, 0x1, 0x42, @remote, @ipv4={'\x00', '\xff\xff', @remote}, 0x80, 0x40, 0xffff, 0x5}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000480)={'syztnl2\x00', 0x0, 0x700, 0x0, 0x8, 0x40, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x66, 0x0, 0xff, 0x29, 0x0, @multicast1, @local, {[@noop, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000540)={'batadv_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) r13 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r13, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', r14}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000005c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl2\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x80, 0x1, 0x40, @mcast2, @dev={0xfe, 0x80, '\x00', 0x19}, 0x1, 0x20, 0x3, 0x3}}) r18 = socket$inet6_udplite(0xa, 0x2, 0x88) r19 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r18, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r19, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r20, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000000d80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000d40)={&(0x7f0000000700)={0x618, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0xac, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}]}}, {{0x8, 0x1, r4}, {0x178, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r10}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r12}, {0x24c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xed8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r14}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x20}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r15}, {0x130, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x5b}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r17}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r20}}}]}}]}, 0x618}, 0x1, 0x0, 0x0, 0x8051}, 0x8040) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000000000155e06302d2cfa0d65ea979ff1faad1551ff3db590f990de6ab2ba1ff2f355de5dcb49b54bb70b6c58f32e899757f4af96b8b045a4fe62a6528b492d5521be17", @ANYRES16=r2, @ANYBLOB="00082abd7000fbdbdf250200000008003c000900000008003c00e00c000005002d0000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 10:17:31 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="79797a746e6c300004fbcef458000000", @ANYRESOCT=r0, @ANYBLOB="00000080ef00006400201f291b000000000000000000481a7f315ab31f3d2368e61aeaa82f8db8b93fe5320b44c9196c5c2dcb67099363fdc2397c65f737dfb1600815a19b334af8aa1dabd77fc53e8b8311b54d86971326af5b0b440e8553e5ce689b6a8df2db2ecb64705394513a0c314f60fe310c0b8eeca77f27ea8b515e769e1f7e7e86a58cdf282bd5092fffc4cdec3706358bdcee8f5bb3b70f857c8955b051f3fd85546c0435846aff15176c01db5d881d2afa6785388a5f0968524ba5abef555b1bb936ae48158bd6ddc971c2b0bc4277d361ec02bd357079158a405a387dcd70d6299e5a2caba8624a179cc18b61f13faa1977fd3bd91c3d"]}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x8cd42, 0x4) getdents(r0, &(0x7f0000000280)=""/4096, 0x1000) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, &(0x7f00000001c0)={0x0, 0x39, &(0x7f0000000180)="4f1cf8997995c33fcd24eda67ec96a96fff72f2076006d062277b173b1c558a385cc17cd43096f0bfb4211602fc060fe3d21ecababa2b7d97e"}) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000000)={'syztnl2\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x7800, 0x20, 0x7f, 0x7fffffff, {{0x21, 0x4, 0x0, 0x10, 0x84, 0x66, 0x0, 0x7, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x3b}, @local, {[@noop, @rr={0x7, 0x7, 0x34, [@local]}, @timestamp={0x44, 0x8, 0x93, 0x0, 0x7, [0x9]}, @cipso={0x86, 0x13, 0x1, [{0x0, 0xd, "0fd6873d72f328de8eb987"}]}, @noop, @ssrr={0x89, 0x13, 0x38, [@local, @broadcast, @private=0xa010101, @remote]}, @timestamp_prespec={0x44, 0x2c, 0xb4, 0x3, 0x0, [{@dev={0xac, 0x14, 0x14, 0x26}, 0x1}, {@empty}, {@multicast1, 0x9a7}, {@private=0xa010101, 0x1}, {@local, 0x2}]}, @timestamp_addr={0x44, 0xc, 0x33, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}]}]}}}}}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x108, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250, 0xfa}, @fda}, &(0x7f00000000c0)={0x0, 0x20, 0x48}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)={0x0, 0x18, 0x30}}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158, 0x9e}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74, 0x4a}}, &(0x7f00000004c0)={0x0, 0x18, 0x40}}}, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1779.406814][T25760] binder: 25759:25760 ioctl 401c5820 20000000 returned -22 [ 1779.415202][T25763] binder: 25761:25763 ioctl 401c5820 20000000 returned -22 [ 1779.417694][T25764] binder: 25762:25764 ioctl 40086602 20000000 returned -22 [ 1779.438160][T25767] binder: 25765:25767 ioctl 401c5820 20000000 returned -22 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/custom0\x00', 0x800, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) (async) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x29, 0x9b, 0x6, 0x7, 0xc, @mcast1, @private1, 0x80, 0x40, 0xfffffff7, 0x9}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r7, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000380)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000440)={'syztnl1\x00', &(0x7f00000003c0)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x40, 0x1, 0x42, @remote, @ipv4={'\x00', '\xff\xff', @remote}, 0x80, 0x40, 0xffff, 0x5}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000480)={'syztnl2\x00', 0x0, 0x700, 0x0, 0x8, 0x40, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x66, 0x0, 0xff, 0x29, 0x0, @multicast1, @local, {[@noop, @noop]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000480)={'syztnl2\x00', 0x0, 0x700, 0x0, 0x8, 0x40, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x66, 0x0, 0xff, 0x29, 0x0, @multicast1, @local, {[@noop, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000540)={'batadv_slave_0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000540)={'batadv_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) r13 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r13, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', r14}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000005c0)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000005c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl2\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x80, 0x1, 0x40, @mcast2, @dev={0xfe, 0x80, '\x00', 0x19}, 0x1, 0x20, 0x3, 0x3}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl2\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x80, 0x1, 0x40, @mcast2, @dev={0xfe, 0x80, '\x00', 0x19}, 0x1, 0x20, 0x3, 0x3}}) r18 = socket$inet6_udplite(0xa, 0x2, 0x88) r19 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r18, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r19, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r20, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000000d80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000d40)={&(0x7f0000000700)={0x618, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0xac, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}]}}, {{0x8, 0x1, r4}, {0x178, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r10}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r12}, {0x24c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xed8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r14}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x20}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r15}, {0x130, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x5b}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r17}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r20}}}]}}]}, 0x618}, 0x1, 0x0, 0x0, 0x8051}, 0x8040) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000000000155e06302d2cfa0d65ea979ff1faad1551ff3db590f990de6ab2ba1ff2f355de5dcb49b54bb70b6c58f32e899757f4af96b8b045a4fe62a6528b492d5521be17", @ANYRES16=r2, @ANYBLOB="00082abd7000fbdbdf250200000008003c000900000008003c00e00c000005002d0000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000001980), 0x0, 0x0) ioctl$EVIOCGNAME(r1, 0x40284504, &(0x7f0000000000)=""/4096) r2 = syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)=0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001080)=@o_path={&(0x7f0000001040)='./file0\x00', 0x0, 0x4018, r1}, 0x18) io_uring_register$IORING_REGISTER_PROBE(r2, 0x18, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000001000)=ANY=[@ANYRESDEC=r3, @ANYRES32, @ANYRESHEX=r1]}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x8, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406900, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1779.476990][T25778] binder: 25777:25778 ioctl 40086602 20000000 returned -22 [ 1779.487925][T25783] binder: 25782:25783 ioctl 401c5820 20000000 returned -22 [ 1779.489184][T25787] binder: 25780:25787 ioctl 40086602 20000000 returned -22 [ 1779.502839][T25781] binder: 25779:25781 ioctl 401c5820 20000000 returned -22 [ 1779.513861][T25794] binder: 25792:25794 ioctl 40086602 20000000 returned -22 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000001980), 0x0, 0x0) ioctl$EVIOCGNAME(r1, 0x40284504, &(0x7f0000000000)=""/4096) r2 = syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)=0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001080)=@o_path={&(0x7f0000001040)='./file0\x00', 0x0, 0x4018, r1}, 0x18) io_uring_register$IORING_REGISTER_PROBE(r2, 0x18, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000001000)=ANY=[@ANYRESDEC=r3, @ANYRES32, @ANYRESHEX=r1]}) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_open_dev$evdev(&(0x7f0000001980), 0x0, 0x0) (async) ioctl$EVIOCGNAME(r1, 0x40284504, &(0x7f0000000000)=""/4096) (async) syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001080)=@o_path={&(0x7f0000001040)='./file0\x00', 0x0, 0x4018, r1}, 0x18) (async) io_uring_register$IORING_REGISTER_PROBE(r2, 0x18, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000001000)=ANY=[@ANYRESDEC=r3, @ANYRES32, @ANYRESHEX=r1]}) (async) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x9, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/custom0\x00', 0x800, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000340)={'ip6gre0\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x29, 0x9b, 0x6, 0x7, 0xc, @mcast1, @private1, 0x80, 0x40, 0xfffffff7, 0x9}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r7, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000380)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000440)={'syztnl1\x00', &(0x7f00000003c0)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x40, 0x1, 0x42, @remote, @ipv4={'\x00', '\xff\xff', @remote}, 0x80, 0x40, 0xffff, 0x5}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000480)={'syztnl2\x00', 0x0, 0x700, 0x0, 0x8, 0x40, {{0x6, 0x4, 0x1, 0x8, 0x18, 0x66, 0x0, 0xff, 0x29, 0x0, @multicast1, @local, {[@noop, @noop]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000540)={'batadv_slave_0\x00', 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000580)={'team0\x00', 0x0}) (async) r13 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r13, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', r14}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000005c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl2\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x4, 0x4, 0x80, 0x1, 0x40, @mcast2, @dev={0xfe, 0x80, '\x00', 0x19}, 0x1, 0x20, 0x3, 0x3}}) (async) r18 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) r19 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r18, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r19, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r20, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000000d80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000d40)={&(0x7f0000000700)={0x618, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0xac, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}]}}, {{0x8, 0x1, r4}, {0x178, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r10}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r11}}}]}}, {{0x8}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x800}}}]}}, {{0x8, 0x1, r12}, {0x24c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xed8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r14}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x20}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7fffffff}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}, {{0x8, 0x1, r15}, {0x130, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x5b}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r17}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x200}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r20}}}]}}]}, 0x618}, 0x1, 0x0, 0x0, 0x8051}, 0x8040) (async) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000000000155e06302d2cfa0d65ea979ff1faad1551ff3db590f990de6ab2ba1ff2f355de5dcb49b54bb70b6c58f32e899757f4af96b8b045a4fe62a6528b492d5521be17", @ANYRES16=r2, @ANYBLOB="00082abd7000fbdbdf250200000008003c000900000008003c00e00c000005002d0000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = io_uring_setup(0x934, &(0x7f0000000000)={0x0, 0x1c93, 0x400, 0x1, 0x3d}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f0000000080)=[0x4, 0x8000], 0x2) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xa, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000001980), 0x0, 0x0) ioctl$EVIOCGNAME(r1, 0x40284504, &(0x7f0000000000)=""/4096) r2 = syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)=0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001080)=@o_path={&(0x7f0000001040)='./file0\x00', 0x0, 0x4018, r1}, 0x18) io_uring_register$IORING_REGISTER_PROBE(r2, 0x18, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000001000)=ANY=[@ANYRESDEC=r3, @ANYRES32, @ANYRESHEX=r1]}) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_open_dev$evdev(&(0x7f0000001980), 0x0, 0x0) (async) ioctl$EVIOCGNAME(r1, 0x40284504, &(0x7f0000000000)=""/4096) (async) syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001080)=@o_path={&(0x7f0000001040)='./file0\x00', 0x0, 0x4018, r1}, 0x18) (async) io_uring_register$IORING_REGISTER_PROBE(r2, 0x18, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000001000)=ANY=[@ANYRESDEC=r3, @ANYRES32, @ANYRESHEX=r1]}) (async) [ 1779.536330][T25797] binder: 25796:25797 ioctl 401c5820 20000000 returned -22 [ 1779.547784][T25801] binder: 25800:25801 ioctl 40086602 20000000 returned -22 [ 1779.558909][T25806] binder: 25802:25806 ioctl 401c5820 20000000 returned -22 [ 1779.567704][T25813] binder: 25812:25813 ioctl 40086602 20000000 returned -22 [ 1779.573121][T25818] binder: 25817:25818 ioctl 401c5820 20000000 returned -22 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40405800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xb, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) (fail_nth: 1) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406f00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1779.591721][T25820] binder: 25819:25820 ioctl 40086602 20000000 returned -22 [ 1779.607298][T25826] binder: 25821:25826 ioctl 401c5820 200004c0 returned -22 [ 1779.611860][T25834] binder: 25825:25834 ioctl 401c5820 20000000 returned -22 [ 1779.617022][T25835] binder: 25833:25835 ioctl 401c5820 20000000 returned -22 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406305, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_io_uring_setup(0x371a, &(0x7f0000000200)={0x0, 0x57a8, 0x40, 0x1, 0x396}, &(0x7f0000000040), &(0x7f0000000280)) io_uring_enter(r1, 0x5145, 0x4940, 0xe, &(0x7f00000002c0)={[0x400]}, 0x8) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x401c2, 0x3c) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) futimesat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{0x0, 0x2710}, {r3, r4/1000+60000}}) r5 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r5, 0x8000000) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000500)={0x58, 0x0, &(0x7f0000000440)=[@request_death={0x400c630e, 0x3}, @enter_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@fda={0x66646185, 0x6, 0x0, 0x11}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/127, 0x7f, 0x2, 0x27}, @fda={0x66646185, 0x1, 0x0, 0x16}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}}], 0x2c, 0x0, &(0x7f00000004c0)="96eba5b25e885ffabfad3987d6bd2218ca6f9dd6e577ebc687eeeaef9ce45b7e20b68648a0aff1a8509fe032"}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="79798aa33c8d3000f800000000cfd9229a9a9bfa0a1c92799a13f4b200c8b5c1ad532e76c02605d19fdb6f6f9671295d30d9c2000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29", @ANYRES32=r3, @ANYRES16=0x0, @ANYRESDEC=r3]}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r1 = io_uring_setup(0x934, &(0x7f0000000000)={0x0, 0x1c93, 0x400, 0x1, 0x3d}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f0000000080)=[0x4, 0x8000], 0x2) [ 1779.638735][T25837] binder: 25836:25837 ioctl 40086602 20000000 returned -22 [ 1779.643702][T25839] FAULT_INJECTION: forcing a failure. [ 1779.643702][T25839] name failslab, interval 1, probability 0, space 0, times 0 [ 1779.659438][T25844] binder: 25843:25844 ioctl 401c5820 20000000 returned -22 [ 1779.667020][T25845] binder: 25841:25845 ioctl 401c5820 20000000 returned -22 [ 1779.670910][T25839] CPU: 1 PID: 25839 Comm: syz-executor.0 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1779.675940][T25846] binder: 25842:25846 ioctl 401c5820 200004c0 returned -22 [ 1779.684107][T25839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1779.684122][T25839] Call Trace: [ 1779.684127][T25839] [ 1779.684134][T25839] dump_stack_lvl+0x151/0x1b7 [ 1779.684161][T25839] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1779.684184][T25839] ? vfs_fileattr_set+0x1b7/0xd30 [ 1779.684206][T25839] dump_stack+0x15/0x1e [ 1779.725952][T25839] should_fail_ex+0x3d0/0x520 [ 1779.730642][T25839] ? binder_get_thread+0x1cb/0x830 [ 1779.735774][T25839] __should_failslab+0xaf/0xf0 [ 1779.740379][T25839] should_failslab+0x9/0x20 [ 1779.744717][T25839] __kmem_cache_alloc_node+0x3d/0x250 [ 1779.749957][T25839] ? binder_get_thread+0x1cb/0x830 [ 1779.754883][T25839] kmalloc_trace+0x2a/0xa0 [ 1779.759127][T25839] binder_get_thread+0x1cb/0x830 [ 1779.763986][T25839] binder_ioctl+0x240/0x2260 [ 1779.768412][T25839] ? proc_fail_nth_write+0x20b/0x290 [ 1779.773535][T25839] ? proc_fail_nth_read+0x210/0x210 [ 1779.778567][T25839] ? fsnotify_perm+0x6a/0x5d0 [ 1779.783079][T25839] ? binder_poll+0x240/0x240 [ 1779.787618][T25839] ? file_has_perm+0x508/0x6c0 [ 1779.792211][T25839] ? match_file+0x140/0x140 [ 1779.796655][T25839] ? selinux_file_ioctl+0x1f3/0x540 [ 1779.801679][T25839] ? __mutex_lock_slowpath+0x10/0x10 [ 1779.806793][T25839] ? selinux_file_alloc_security+0x120/0x120 [ 1779.812611][T25839] ? __fget_files+0x2cb/0x330 [ 1779.817211][T25839] ? security_file_ioctl+0x84/0xb0 [ 1779.822257][T25839] ? binder_poll+0x240/0x240 [ 1779.826761][T25839] __se_sys_ioctl+0x114/0x190 [ 1779.831308][T25839] __x64_sys_ioctl+0x7b/0x90 [ 1779.835694][T25839] do_syscall_64+0x3d/0xb0 [ 1779.840043][T25839] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1779.845764][T25839] RIP: 0033:0x7efdd207cda9 [ 1779.850017][T25839] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1779.869635][T25839] RSP: 002b:00007efdd2cfe0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1779.877887][T25839] RAX: ffffffffffffffda RBX: 00007efdd21abf80 RCX: 00007efdd207cda9 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406306, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = io_uring_setup(0x934, &(0x7f0000000000)={0x0, 0x1c93, 0x400, 0x1, 0x3d}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f0000000080)=[0x4, 0x8000], 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) io_uring_setup(0x934, &(0x7f0000000000)={0x0, 0x1c93, 0x400, 0x1, 0x3d}) (async) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r1, 0x13, &(0x7f0000000080)=[0x4, 0x8000], 0x2) (async) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xc, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_io_uring_setup(0x371a, &(0x7f0000000200)={0x0, 0x57a8, 0x40, 0x1, 0x396}, &(0x7f0000000040), &(0x7f0000000280)) io_uring_enter(r1, 0x5145, 0x4940, 0xe, &(0x7f00000002c0)={[0x400]}, 0x8) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x401c2, 0x3c) (async) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) futimesat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{0x0, 0x2710}, {r3, r4/1000+60000}}) (async) r5 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r5, 0x8000000) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000500)={0x58, 0x0, &(0x7f0000000440)=[@request_death={0x400c630e, 0x3}, @enter_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@fda={0x66646185, 0x6, 0x0, 0x11}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/127, 0x7f, 0x2, 0x27}, @fda={0x66646185, 0x1, 0x0, 0x16}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}}], 0x2c, 0x0, &(0x7f00000004c0)="96eba5b25e885ffabfad3987d6bd2218ca6f9dd6e577ebc687eeeaef9ce45b7e20b68648a0aff1a8509fe032"}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="79798aa33c8d3000f800000000cfd9229a9a9bfa0a1c92799a13f4b200c8b5c1ad532e76c02605d19fdb6f6f9671295d30d9c2000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29", @ANYRES32=r3, @ANYRES16=0x0, @ANYRESDEC=r3]}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40407000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1779.885702][T25839] RDX: 0000000020000000 RSI: 0000000040086602 RDI: 0000000000000003 [ 1779.893676][T25839] RBP: 00007efdd2cfe120 R08: 0000000000000000 R09: 0000000000000000 [ 1779.901573][T25839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1779.909399][T25839] R13: 000000000000000b R14: 00007efdd21abf80 R15: 00007ffff9c26aa8 [ 1779.917315][T25839] [ 1779.922132][T25839] binder: 25838:25839 ioctl 40086602 20000000 returned -12 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r1 = syz_io_uring_complete(0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f00000000c0)={&(0x7f0000001000)={[{&(0x7f00000005c0)="3512a76867f5e8a334a8d2b56d775c3f0b91e0c16edc599928e9a9709ce37ff6d9ec1be8619cf4274603815a543fba4ddafd584c44e41e72ed81b363f15e6b89a7d01c04690082a73a6817378a675192bb2c7171ac940c6b288c80d98a516508f821161dccc701f505aef8b41376a99c08a7ccf79d15024f24e7a63cc4563e9f8a15f9f8dc", 0x85, 0x1}, {&(0x7f0000000180)="a6f738fdc742ddb4630b10cff9a21eda7011b4a6dfdcb42fb807d22e09ee502a9a600bddc8e7a7d2a72a3a7aefbe10681d6d469070c43b65fd9c25e9f9e701c06ae5756f8d65155f571aad8f14753c681fa43883b15e1c3f322a1ddb44b9a1d541096fc97578a5f3a3347c2f678652ef5232bc67cc13597dfcc9e6edabe102c5b54ceffb29b17f97ac67da3e907090de12e8da25845a6a3fe89ab07eb6cafee39770564db2980462bfc3f2589cc5c652135bcfaaf3bf7bdc14968c2f8848c68a571ee821e931483e0eb8", 0xca, 0x3}, {&(0x7f0000000280)="440745da897fee7438d602c9b1b25e88b9e4c7c8fcaaf14039cfbe33c0d482959a51fe1ff7de3fac0e2a4a3208d8f900349aeb34ade0d6e6f8fd1bbde13142ce9c200bd80f80de30231242ce1dd1d4f7c95bdd9328306b8e41234f68a5d738e4da3b341bc3861da4fab32daa34524380115a0699c3d37bcd98b00a", 0x7b, 0x3}, {&(0x7f0000000300)="3787d2770e9986aaca793ad58e4b6c4cb08003ef1a9e461e9c989b13c4302364fdec6cd9d849c516420fcc6561fc5313907e19c1c1512c21d647c908dc2d11eb676daaf326c63068bd4b8b0fd89bdebd5caef0c6e69152999da4a9779f71912a20efd78ef7550198cb64a5225dc265de986004391bcefc9dfe874f16d1d47de7e16d", 0x82, 0x2}, {&(0x7f00000003c0)="6d95d4dad9f4fd6a341c936f15f80d70604eae780ea2b47a312c76009c01b7bb74774ac63fe8f1c4915dd399d62820a2b8ccec704da43082f03d8440ab2d5a6951f1cd34494b3c5d2e44c80bf6ed2b29bc7ad5dc5e22d8f50b19cf8a519306807496e809985e7158178abd03741fde8af23f4439a62a7a6182bb97d74d9e78db2bea4167335dd28091a1c7faef397a7800c382bc129646d52f1d3c842c", 0x9d, 0x3}, {&(0x7f0000000500)="41fcea2b17cd08db37f2a968bbd25c096619221c9215c5a74f565ee0e7a733543331b87cdbbf2ec4850be63ce084498cfab101966881e4c21ffe1916c75bfff220ae448c9fc79d23a715db1a389014f51cfa825a3badd3f384e95a40dc20698cd7c399f94c85a305c22be533202cf8c116e69c7d5ba2275005997a6cd4c9e18ae7bbbf0cb6f6ef11398dbd3e29fd25c7a2d58b59597d8b1762ef61eb8cc0f3e33e", 0xa1, 0x3}]}, 0x6, 0x2}, 0x1) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_io_uring_setup(0x371a, &(0x7f0000000200)={0x0, 0x57a8, 0x40, 0x1, 0x396}, &(0x7f0000000040), &(0x7f0000000280)) io_uring_enter(r1, 0x5145, 0x4940, 0xe, &(0x7f00000002c0)={[0x400]}, 0x8) (async) io_uring_enter(r1, 0x5145, 0x4940, 0xe, &(0x7f00000002c0)={[0x400]}, 0x8) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x401c2, 0x3c) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) futimesat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{0x0, 0x2710}, {r3, r4/1000+60000}}) (async) futimesat(r2, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{0x0, 0x2710}, {r3, r4/1000+60000}}) r5 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r5, 0x8000000) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000500)={0x58, 0x0, &(0x7f0000000440)=[@request_death={0x400c630e, 0x3}, @enter_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@fda={0x66646185, 0x6, 0x0, 0x11}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/127, 0x7f, 0x2, 0x27}, @fda={0x66646185, 0x1, 0x0, 0x16}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}}], 0x2c, 0x0, &(0x7f00000004c0)="96eba5b25e885ffabfad3987d6bd2218ca6f9dd6e577ebc687eeeaef9ce45b7e20b68648a0aff1a8509fe032"}) (async) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000500)={0x58, 0x0, &(0x7f0000000440)=[@request_death={0x400c630e, 0x3}, @enter_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@fda={0x66646185, 0x6, 0x0, 0x11}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/127, 0x7f, 0x2, 0x27}, @fda={0x66646185, 0x1, 0x0, 0x16}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}}], 0x2c, 0x0, &(0x7f00000004c0)="96eba5b25e885ffabfad3987d6bd2218ca6f9dd6e577ebc687eeeaef9ce45b7e20b68648a0aff1a8509fe032"}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="79798aa33c8d3000f800000000cfd9229a9a9bfa0a1c92799a13f4b200c8b5c1ad532e76c02605d19fdb6f6f9671295d30d9c2000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29", @ANYRES32=r3, @ANYRES16=0x0, @ANYRESDEC=r3]}) 10:17:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) (fail_nth: 2) [ 1779.943547][T25859] binder: 25856:25859 ioctl 401c5820 200004c0 returned -22 [ 1779.943710][T25858] binder: 25857:25858 ioctl 401c5820 20000000 returned -22 [ 1779.958119][T25852] binder: 25850:25852 ioctl 401c5820 20000000 returned -22 [ 1779.960742][T25855] binder: 25853:25855 ioctl 40086602 20000000 returned -22 [ 1779.981074][T25866] binder: 25864:25866 ioctl 401c5820 200004c0 returned -22 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f1000000064503001400646500201f29"]}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f1000000064503001400646500201f29"]}) 10:17:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40407300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r1 = syz_io_uring_complete(0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f00000000c0)={&(0x7f0000001000)={[{&(0x7f00000005c0)="3512a76867f5e8a334a8d2b56d775c3f0b91e0c16edc599928e9a9709ce37ff6d9ec1be8619cf4274603815a543fba4ddafd584c44e41e72ed81b363f15e6b89a7d01c04690082a73a6817378a675192bb2c7171ac940c6b288c80d98a516508f821161dccc701f505aef8b41376a99c08a7ccf79d15024f24e7a63cc4563e9f8a15f9f8dc", 0x85, 0x1}, {&(0x7f0000000180)="a6f738fdc742ddb4630b10cff9a21eda7011b4a6dfdcb42fb807d22e09ee502a9a600bddc8e7a7d2a72a3a7aefbe10681d6d469070c43b65fd9c25e9f9e701c06ae5756f8d65155f571aad8f14753c681fa43883b15e1c3f322a1ddb44b9a1d541096fc97578a5f3a3347c2f678652ef5232bc67cc13597dfcc9e6edabe102c5b54ceffb29b17f97ac67da3e907090de12e8da25845a6a3fe89ab07eb6cafee39770564db2980462bfc3f2589cc5c652135bcfaaf3bf7bdc14968c2f8848c68a571ee821e931483e0eb8", 0xca, 0x3}, {&(0x7f0000000280)="440745da897fee7438d602c9b1b25e88b9e4c7c8fcaaf14039cfbe33c0d482959a51fe1ff7de3fac0e2a4a3208d8f900349aeb34ade0d6e6f8fd1bbde13142ce9c200bd80f80de30231242ce1dd1d4f7c95bdd9328306b8e41234f68a5d738e4da3b341bc3861da4fab32daa34524380115a0699c3d37bcd98b00a", 0x7b, 0x3}, {&(0x7f0000000300)="3787d2770e9986aaca793ad58e4b6c4cb08003ef1a9e461e9c989b13c4302364fdec6cd9d849c516420fcc6561fc5313907e19c1c1512c21d647c908dc2d11eb676daaf326c63068bd4b8b0fd89bdebd5caef0c6e69152999da4a9779f71912a20efd78ef7550198cb64a5225dc265de986004391bcefc9dfe874f16d1d47de7e16d", 0x82, 0x2}, {&(0x7f00000003c0)="6d95d4dad9f4fd6a341c936f15f80d70604eae780ea2b47a312c76009c01b7bb74774ac63fe8f1c4915dd399d62820a2b8ccec704da43082f03d8440ab2d5a6951f1cd34494b3c5d2e44c80bf6ed2b29bc7ad5dc5e22d8f50b19cf8a519306807496e809985e7158178abd03741fde8af23f4439a62a7a6182bb97d74d9e78db2bea4167335dd28091a1c7faef397a7800c382bc129646d52f1d3c842c", 0x9d, 0x3}, {&(0x7f0000000500)="41fcea2b17cd08db37f2a968bbd25c096619221c9215c5a74f565ee0e7a733543331b87cdbbf2ec4850be63ce084498cfab101966881e4c21ffe1916c75bfff220ae448c9fc79d23a715db1a389014f51cfa825a3badd3f384e95a40dc20698cd7c399f94c85a305c22be533202cf8c116e69c7d5ba2275005997a6cd4c9e18ae7bbbf0cb6f6ef11398dbd3e29fd25c7a2d58b59597d8b1762ef61eb8cc0f3e33e", 0xa1, 0x3}]}, 0x6, 0x2}, 0x1) 10:17:31 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xd, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f1000000064503001400646500201f29"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f1000000064503001400646500201f29"]}) 10:17:31 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1779.987076][T25869] binder: 25868:25869 ioctl 40086602 20000000 returned -22 [ 1780.001880][T25869] FAULT_INJECTION: forcing a failure. [ 1780.001880][T25869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1780.023768][T25876] binder: 25874:25876 ioctl 401c5820 20000000 returned -22 [ 1780.029274][T25879] binder: 25875:25879 ioctl 401c5820 200004c0 returned -22 10:17:31 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=r0, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) socket$inet_udp(0x2, 0x2, 0x0) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r1 = syz_io_uring_complete(0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f00000000c0)={&(0x7f0000001000)={[{&(0x7f00000005c0)="3512a76867f5e8a334a8d2b56d775c3f0b91e0c16edc599928e9a9709ce37ff6d9ec1be8619cf4274603815a543fba4ddafd584c44e41e72ed81b363f15e6b89a7d01c04690082a73a6817378a675192bb2c7171ac940c6b288c80d98a516508f821161dccc701f505aef8b41376a99c08a7ccf79d15024f24e7a63cc4563e9f8a15f9f8dc", 0x85, 0x1}, {&(0x7f0000000180)="a6f738fdc742ddb4630b10cff9a21eda7011b4a6dfdcb42fb807d22e09ee502a9a600bddc8e7a7d2a72a3a7aefbe10681d6d469070c43b65fd9c25e9f9e701c06ae5756f8d65155f571aad8f14753c681fa43883b15e1c3f322a1ddb44b9a1d541096fc97578a5f3a3347c2f678652ef5232bc67cc13597dfcc9e6edabe102c5b54ceffb29b17f97ac67da3e907090de12e8da25845a6a3fe89ab07eb6cafee39770564db2980462bfc3f2589cc5c652135bcfaaf3bf7bdc14968c2f8848c68a571ee821e931483e0eb8", 0xca, 0x3}, {&(0x7f0000000280)="440745da897fee7438d602c9b1b25e88b9e4c7c8fcaaf14039cfbe33c0d482959a51fe1ff7de3fac0e2a4a3208d8f900349aeb34ade0d6e6f8fd1bbde13142ce9c200bd80f80de30231242ce1dd1d4f7c95bdd9328306b8e41234f68a5d738e4da3b341bc3861da4fab32daa34524380115a0699c3d37bcd98b00a", 0x7b, 0x3}, {&(0x7f0000000300)="3787d2770e9986aaca793ad58e4b6c4cb08003ef1a9e461e9c989b13c4302364fdec6cd9d849c516420fcc6561fc5313907e19c1c1512c21d647c908dc2d11eb676daaf326c63068bd4b8b0fd89bdebd5caef0c6e69152999da4a9779f71912a20efd78ef7550198cb64a5225dc265de986004391bcefc9dfe874f16d1d47de7e16d", 0x82, 0x2}, {&(0x7f00000003c0)="6d95d4dad9f4fd6a341c936f15f80d70604eae780ea2b47a312c76009c01b7bb74774ac63fe8f1c4915dd399d62820a2b8ccec704da43082f03d8440ab2d5a6951f1cd34494b3c5d2e44c80bf6ed2b29bc7ad5dc5e22d8f50b19cf8a519306807496e809985e7158178abd03741fde8af23f4439a62a7a6182bb97d74d9e78db2bea4167335dd28091a1c7faef397a7800c382bc129646d52f1d3c842c", 0x9d, 0x3}, {&(0x7f0000000500)="41fcea2b17cd08db37f2a968bbd25c096619221c9215c5a74f565ee0e7a733543331b87cdbbf2ec4850be63ce084498cfab101966881e4c21ffe1916c75bfff220ae448c9fc79d23a715db1a389014f51cfa825a3badd3f384e95a40dc20698cd7c399f94c85a305c22be533202cf8c116e69c7d5ba2275005997a6cd4c9e18ae7bbbf0cb6f6ef11398dbd3e29fd25c7a2d58b59597d8b1762ef61eb8cc0f3e33e", 0xa1, 0x3}]}, 0x6, 0x2}, 0x1) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=r0, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async, rerun: 64) socket$inet_udp(0x2, 0x2, 0x0) (rerun: 64) [ 1780.042004][T25878] binder: 25877:25878 ioctl 40086602 20000000 returned -22 [ 1780.043902][T25869] CPU: 1 PID: 25869 Comm: syz-executor.0 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1780.051330][T25884] binder: 25883:25884 ioctl 401c5820 20000000 returned -22 [ 1780.059010][T25869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1780.059028][T25869] Call Trace: [ 1780.059034][T25869] [ 1780.059042][T25869] dump_stack_lvl+0x151/0x1b7 [ 1780.086352][T25869] ? nf_tcp_handle_invalid+0x3f1/0x3f1 10:17:32 executing program 5: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x5, 0x20010, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000000), 0x0, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=r0, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) socket$inet_udp(0x2, 0x2, 0x0) [ 1780.091648][T25869] ? _printk+0xd1/0x111 [ 1780.095658][T25869] dump_stack+0x15/0x1e [ 1780.099633][T25869] should_fail_ex+0x3d0/0x520 [ 1780.100248][T25888] binder: 25887:25888 ioctl 401c5820 200004c0 returned -22 [ 1780.104168][T25869] should_fail+0xb/0x10 [ 1780.115172][T25869] should_fail_usercopy+0x1a/0x20 [ 1780.120034][T25869] _copy_to_user+0x1e/0x90 [ 1780.124458][T25869] simple_read_from_buffer+0xc7/0x150 [ 1780.129752][T25869] proc_fail_nth_read+0x1a3/0x210 [ 1780.134610][T25869] ? proc_fault_inject_write+0x390/0x390 10:17:32 executing program 5: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x5, 0x20010, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000000), 0x0, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter, 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 5: r0 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x5, 0x20010, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r0, 0x118, &(0x7f0000000000), 0x0, 0x4) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1780.139863][T25893] binder: 25892:25893 ioctl 401c5820 200004c0 returned -22 [ 1780.140071][T25869] ? fsnotify_perm+0x470/0x5d0 [ 1780.151709][T25869] ? security_file_permission+0x86/0xb0 [ 1780.157089][T25869] ? proc_fault_inject_write+0x390/0x390 [ 1780.162074][T25900] binder: 25899:25900 ioctl 401c5820 200004c0 returned -22 [ 1780.162553][T25869] vfs_read+0x26c/0xad0 [ 1780.173580][T25869] ? kernel_read+0x1f0/0x1f0 [ 1780.178005][T25869] ? mutex_lock+0xb1/0x1e0 [ 1780.182269][T25869] ? bit_wait_io_timeout+0x120/0x120 [ 1780.182494][T25903] binder: 25902:25903 ioctl 401c5820 200004c0 returned -22 10:17:32 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter, 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PROBE(r1, 0x5, &(0x7f00000006c0), 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x800, 0x10000) r3 = gettid() ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000040)={'\x00', 0x8, 0x40000, 0x0, 0x4, 0x266, r3}) r4 = socket$nl_audit(0x10, 0x3, 0x9) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000040)=[r0, r2, r4, r0, r0, r0, r0, r0, r0], 0x9) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r5) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PROBE(r1, 0x5, &(0x7f00000006c0), 0x0) (async) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x800, 0x10000) r3 = gettid() ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000040)={'\x00', 0x8, 0x40000, 0x0, 0x4, 0x266, r3}) (async) r4 = socket$nl_audit(0x10, 0x3, 0x9) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000040)=[r0, r2, r4, r0, r0, r0, r0, r0, r0], 0x9) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r5) [ 1780.187468][T25869] ? __fdget_pos+0x2e2/0x390 [ 1780.187501][T25869] ? ksys_read+0x77/0x2c0 [ 1780.187521][T25869] ksys_read+0x199/0x2c0 [ 1780.187539][T25869] ? vfs_write+0xeb0/0xeb0 [ 1780.187556][T25869] ? fpregs_restore_userregs+0x130/0x290 [ 1780.210938][T25909] binder: 25908:25909 ioctl 401c5820 200004c0 returned -22 [ 1780.212039][T25869] __x64_sys_read+0x7b/0x90 [ 1780.212070][T25869] do_syscall_64+0x3d/0xb0 [ 1780.233134][T25869] entry_SYSCALL_64_after_hwframe+0x63/0xcd 10:17:32 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter, 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) [ 1780.238042][T25913] binder: 25912:25913 ioctl 401c5820 200004c0 returned -22 [ 1780.239001][T25869] RIP: 0033:0x7efdd207ba4c [ 1780.239024][T25869] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 59 81 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 af 81 02 00 48 [ 1780.266373][T25918] binder: 25917:25918 ioctl 401c5820 200004c0 returned -22 [ 1780.271544][T25869] RSP: 002b:00007efdd2cfe0c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1780.271569][T25869] RAX: ffffffffffffffda RBX: 00007efdd21abf80 RCX: 00007efdd207ba4c 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r1 = syz_io_uring_setup(0x447a, &(0x7f0000000000), &(0x7f0000000680), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_PROBE(r1, 0x5, &(0x7f00000006c0), 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x800, 0x10000) r3 = gettid() ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000040)={'\x00', 0x8, 0x40000, 0x0, 0x4, 0x266, r3}) (async) r4 = socket$nl_audit(0x10, 0x3, 0x9) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000040)=[r0, r2, r4, r0, r0, r0, r0, r0, r0], 0x9) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r5) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x7}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x88}]}, 0x24}, 0x1, 0x0, 0x0, 0x60008884}, 0x40) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x7}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x88}]}, 0x24}, 0x1, 0x0, 0x0, 0x60008884}, 0x40) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406308, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r2, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x7}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x88}]}, 0x24}, 0x1, 0x0, 0x0, 0x60008884}, 0x40) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xe, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40407400, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.294633][T25869] RDX: 000000000000000f RSI: 00007efdd2cfe130 RDI: 0000000000000004 [ 1780.302458][T25869] RBP: 00007efdd2cfe120 R08: 0000000000000000 R09: 0000000000000000 [ 1780.310254][T25869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1780.318071][T25869] R13: 000000000000000b R14: 00007efdd21abf80 R15: 00007ffff9c26aa8 [ 1780.325902][T25869] 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x800, 0x0) r2 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x0) io_setup(0x5, &(0x7f0000000880)=0x0) io_cancel(r3, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x3, 0x8000, r2, &(0x7f00000008c0)="83d9256a677a37b66753f7", 0xb, 0x2, 0x0, 0x1}, &(0x7f0000000940)) utimensat(r2, 0x0, 0x0, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000680), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000740)={'gretap0\x00', &(0x7f0000000700)={'gretap0\x00', 0x0, 0x8, 0x8, 0x800, 0xbc0, {{0x8, 0x4, 0x1, 0x8, 0x20, 0x67, 0x0, 0x4, 0x29, 0x0, @loopback, @multicast2, {[@timestamp_addr={0x44, 0xc, 0xc6, 0x1, 0x4, [{@multicast2, 0x81}]}]}}}}}) r7 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) read$char_usb(r7, &(0x7f00000001c0)=""/237, 0xed) write$P9_RMKNOD(r7, &(0x7f0000000a80)={0x14, 0x13, 0x2, {0x1, 0x0, 0x5}}, 0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000840)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r4, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20512cbe}}, {0x8, 0x6, r6}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x840) r8 = io_uring_setup(0xa1b, &(0x7f0000000040)={0x0, 0xa45e, 0x20, 0x3, 0x3bd}) io_uring_register$IORING_REGISTER_PBUF_RING(r8, 0x16, &(0x7f0000000600)={&(0x7f0000001000)={[{&(0x7f00000000c0)="7a994b858f823fa5323a7a049bb4daced27c61d2a9936cea63a64ca88601e314576b684d1021c146ef594d13ea517964a7ac4c7cf7ff11", 0x37, 0x3}, {&(0x7f00000001c0)="fe67eeeabd82dfcde997468c2f3760dc9b184edd82a3ac20e58c0adaba63c246492446bca29a60f3fc528ce3d47bde7febfbba", 0x33, 0x2}, {&(0x7f0000000200)="11d1c04b02b00a540b65a6ad60a5e7fae4999949ff0501d8a8d9849d97de899ba604ab81e7334cfe19ffb98f7f8d22ab6d59f944d493a8d569e2051d24a6a8b351fe6cabcc66367ac33bc23399649c2bcb9babdfa0aa5f977b7253bfb4db041713855d261ed9454f479f7262d7f46899e7f4101f2f5796087d1054349d5580a31baf85497a26", 0x86}, {&(0x7f00000002c0)="4496ea2bdec6b765773c84946157564a1f4d7e86c671f3fa3352887765e6f31bd120d13fc407f0054cf036858b630d5bb620c21a563fd5c0663525f712e5eeb3c46228b8739e80a8db32fee456994355cba0ccde7d1496adda", 0x59}, {&(0x7f0000000340)="935693042c24815b3fe23e875c4764713d8bd4063d8c4cd28ea6051e6c713e530ac0912bfd17c6f42320f98f9d006b97edf62923223bf64cc18f174743167ea63b1c1f7806a3991ff1ac33b6", 0x4c}, {&(0x7f00000003c0)="0f2e84dbb9aa9c13419385561efea429b0f1fd983405fe35410b3b0b3cbdc0fdb2e2753308eb0808a04088ae79cf2a310be4a33c780885a1aef0f3a2857ccafa59407bf4f18b325d8e584f34df6d9755b06aeb460181704840a366be3727dd5a480bb8d5b1b6c3cb35ef08fabb2207b839e8dd13e040accac5878b9091d1d36e6bed3bf24d160ee1991a9d5a591238cdbb195c72ab", 0x95, 0x3}, {&(0x7f0000000480)="84438f0dcdb6d3fa16fe5f0cb64223603e34dc920220ab33", 0x18, 0x1}, {&(0x7f0000000500)="d4a389ebd3d93f6482f23d99845083b6f4cd39b125a070a542f57d130acb005d3aaf5031ef799b84e6ca79cccf432183569c497a098a5fa3ecf7beb9d8f9a0ebacd480af95156bc57cd88966d908df1b53708562cb7c5d5f434490aa2a644ad61096e493199f987f40103ce3e496459a4ac0feceaff0b48a8873d5ac93cfe4c08a71c5e8e5617fe582839b77ee5ed0187ee723a7438a9e095abe86aea2a959894acf8872cd1c1c27e04dc656b29a301afde7bcecc53c20f254c94e4a02c17a1a11dc46adc834bce9f5df21980ee127a20943bc", 0xd3, 0x2}]}, 0x8, 0x1}, 0x1) getitimer(0x2, &(0x7f0000000a40)) r9 = syz_io_uring_complete(0x0) write$tun(0xffffffffffffffff, &(0x7f00000009c0)={@void, @val={0x1, 0x80, 0x4, 0x4, 0x2, 0x8}, @ipv4=@tipc={{0x11, 0x4, 0x0, 0x27, 0x6d, 0x68, 0x0, 0x1c, 0x6, 0x0, @empty, @empty, {[@end, @lsrr={0x83, 0x23, 0x7b, [@private=0xa010102, @private=0xa010101, @empty, @multicast1, @loopback, @local, @private=0xa010100, @loopback]}, @end, @rr={0x7, 0x7, 0x42, [@local]}, @ra={0x94, 0x4}]}}, @payload_named={{{{{0x29, 0x0, 0x0, 0x0, 0x1, 0xa, 0x3, 0x2, 0x5, 0x0, 0x1, 0x0, 0x3, 0x2, 0x5, 0x6, 0x1, 0x4e20, 0x4e24}, 0x0, 0x3}, 0x3, 0x3}}, [0x0]}}}, 0x77) syz_genetlink_get_family_id$batadv(&(0x7f0000000980), r9) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3c4000000) r10 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r10, 0x10000000) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r10, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x8000, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000000000Q0140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB=',allow_other,max_read=0x0000000000000008,max_read=0x00000000000001ff,max_read=0x0000000000001000,mask=MAY_READ,\x00'], 0x0, 0x0, &(0x7f0000000200)="ec4ef4f7c18dfb185ef612837e8649a475937d4309aac005ceca6e77f530d22a38f957b98df7906c530837d991095da83c22a089b856351c530c6d54d93dd334701b8f93f7a82d2249fb752c303353ab4706a762a6146d1b80012a3359dd191cd7a35faa31fc887d") mknodat(r1, &(0x7f0000000280)='./file0\x00', 0x4, 0x63d17771) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) connect$bt_rfcomm(r2, &(0x7f0000000240), 0xa) write$P9_RMKNOD(r2, &(0x7f00000002c0)={0x14, 0x13, 0x2, {0x2, 0x2}}, 0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x10, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.344630][T25925] binder: 25924:25925 ioctl 401c5820 20000000 returned -22 [ 1780.355038][T25928] binder: 25926:25928 ioctl 40086602 20000000 returned -22 [ 1780.356201][T25929] binder: 25927:25929 ioctl 401c5820 20000000 returned -22 [ 1780.378976][T25933] binder: 25932:25933 ioctl 401c5820 200004c0 returned -22 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40407500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x11, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40407800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.391110][T25936] binder: 25935:25936 ioctl 40086602 20000000 returned -22 [ 1780.410489][T25940] binder: 25939:25940 ioctl 401c5820 20000000 returned -22 [ 1780.418518][T25941] binder: 25938:25941 ioctl 401c5820 20000000 returned -22 [ 1780.429463][T25937] fuse: Bad value for 'fd' [ 1780.433931][T25944] binder: 25943:25944 ioctl 40086602 20000000 returned -22 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) (async) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x8000, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000000000Q0140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB=',allow_other,max_read=0x0000000000000008,max_read=0x00000000000001ff,max_read=0x0000000000001000,mask=MAY_READ,\x00'], 0x0, 0x0, &(0x7f0000000200)="ec4ef4f7c18dfb185ef612837e8649a475937d4309aac005ceca6e77f530d22a38f957b98df7906c530837d991095da83c22a089b856351c530c6d54d93dd334701b8f93f7a82d2249fb752c303353ab4706a762a6146d1b80012a3359dd191cd7a35faa31fc887d") mknodat(r1, &(0x7f0000000280)='./file0\x00', 0x4, 0x63d17771) (async) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) connect$bt_rfcomm(r2, &(0x7f0000000240), 0xa) (async) write$P9_RMKNOD(r2, &(0x7f00000002c0)={0x14, 0x13, 0x2, {0x2, 0x2}}, 0x14) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 64) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x800, 0x0) (rerun: 64) r2 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x0) (async) io_setup(0x5, &(0x7f0000000880)=0x0) io_cancel(r3, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x3, 0x8000, r2, &(0x7f00000008c0)="83d9256a677a37b66753f7", 0xb, 0x2, 0x0, 0x1}, &(0x7f0000000940)) utimensat(r2, 0x0, 0x0, 0x0) (async, rerun: 32) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000680), 0xffffffffffffffff) (rerun: 32) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000740)={'gretap0\x00', &(0x7f0000000700)={'gretap0\x00', 0x0, 0x8, 0x8, 0x800, 0xbc0, {{0x8, 0x4, 0x1, 0x8, 0x20, 0x67, 0x0, 0x4, 0x29, 0x0, @loopback, @multicast2, {[@timestamp_addr={0x44, 0xc, 0xc6, 0x1, 0x4, [{@multicast2, 0x81}]}]}}}}}) r7 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) read$char_usb(r7, &(0x7f00000001c0)=""/237, 0xed) write$P9_RMKNOD(r7, &(0x7f0000000a80)={0x14, 0x13, 0x2, {0x1, 0x0, 0x5}}, 0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000840)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r4, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20512cbe}}, {0x8, 0x6, r6}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x840) (async) r8 = io_uring_setup(0xa1b, &(0x7f0000000040)={0x0, 0xa45e, 0x20, 0x3, 0x3bd}) io_uring_register$IORING_REGISTER_PBUF_RING(r8, 0x16, &(0x7f0000000600)={&(0x7f0000001000)={[{&(0x7f00000000c0)="7a994b858f823fa5323a7a049bb4daced27c61d2a9936cea63a64ca88601e314576b684d1021c146ef594d13ea517964a7ac4c7cf7ff11", 0x37, 0x3}, {&(0x7f00000001c0)="fe67eeeabd82dfcde997468c2f3760dc9b184edd82a3ac20e58c0adaba63c246492446bca29a60f3fc528ce3d47bde7febfbba", 0x33, 0x2}, {&(0x7f0000000200)="11d1c04b02b00a540b65a6ad60a5e7fae4999949ff0501d8a8d9849d97de899ba604ab81e7334cfe19ffb98f7f8d22ab6d59f944d493a8d569e2051d24a6a8b351fe6cabcc66367ac33bc23399649c2bcb9babdfa0aa5f977b7253bfb4db041713855d261ed9454f479f7262d7f46899e7f4101f2f5796087d1054349d5580a31baf85497a26", 0x86}, {&(0x7f00000002c0)="4496ea2bdec6b765773c84946157564a1f4d7e86c671f3fa3352887765e6f31bd120d13fc407f0054cf036858b630d5bb620c21a563fd5c0663525f712e5eeb3c46228b8739e80a8db32fee456994355cba0ccde7d1496adda", 0x59}, {&(0x7f0000000340)="935693042c24815b3fe23e875c4764713d8bd4063d8c4cd28ea6051e6c713e530ac0912bfd17c6f42320f98f9d006b97edf62923223bf64cc18f174743167ea63b1c1f7806a3991ff1ac33b6", 0x4c}, {&(0x7f00000003c0)="0f2e84dbb9aa9c13419385561efea429b0f1fd983405fe35410b3b0b3cbdc0fdb2e2753308eb0808a04088ae79cf2a310be4a33c780885a1aef0f3a2857ccafa59407bf4f18b325d8e584f34df6d9755b06aeb460181704840a366be3727dd5a480bb8d5b1b6c3cb35ef08fabb2207b839e8dd13e040accac5878b9091d1d36e6bed3bf24d160ee1991a9d5a591238cdbb195c72ab", 0x95, 0x3}, {&(0x7f0000000480)="84438f0dcdb6d3fa16fe5f0cb64223603e34dc920220ab33", 0x18, 0x1}, {&(0x7f0000000500)="d4a389ebd3d93f6482f23d99845083b6f4cd39b125a070a542f57d130acb005d3aaf5031ef799b84e6ca79cccf432183569c497a098a5fa3ecf7beb9d8f9a0ebacd480af95156bc57cd88966d908df1b53708562cb7c5d5f434490aa2a644ad61096e493199f987f40103ce3e496459a4ac0feceaff0b48a8873d5ac93cfe4c08a71c5e8e5617fe582839b77ee5ed0187ee723a7438a9e095abe86aea2a959894acf8872cd1c1c27e04dc656b29a301afde7bcecc53c20f254c94e4a02c17a1a11dc46adc834bce9f5df21980ee127a20943bc", 0xd3, 0x2}]}, 0x8, 0x1}, 0x1) getitimer(0x2, &(0x7f0000000a40)) (async, rerun: 32) r9 = syz_io_uring_complete(0x0) (rerun: 32) write$tun(0xffffffffffffffff, &(0x7f00000009c0)={@void, @val={0x1, 0x80, 0x4, 0x4, 0x2, 0x8}, @ipv4=@tipc={{0x11, 0x4, 0x0, 0x27, 0x6d, 0x68, 0x0, 0x1c, 0x6, 0x0, @empty, @empty, {[@end, @lsrr={0x83, 0x23, 0x7b, [@private=0xa010102, @private=0xa010101, @empty, @multicast1, @loopback, @local, @private=0xa010100, @loopback]}, @end, @rr={0x7, 0x7, 0x42, [@local]}, @ra={0x94, 0x4}]}}, @payload_named={{{{{0x29, 0x0, 0x0, 0x0, 0x1, 0xa, 0x3, 0x2, 0x5, 0x0, 0x1, 0x0, 0x3, 0x2, 0x5, 0x6, 0x1, 0x4e20, 0x4e24}, 0x0, 0x3}, 0x3, 0x3}}, [0x0]}}}, 0x77) (async, rerun: 64) syz_genetlink_get_family_id$batadv(&(0x7f0000000980), r9) (async, rerun: 64) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3c4000000) (async) r10 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r10, 0x10000000) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r10, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x12, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040630b, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40407a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.436001][T25945] binder: 25942:25945 ioctl 40086602 20000000 returned -22 [ 1780.453871][T25947] binder: 25946:25947 ioctl 401c5820 20000000 returned -22 [ 1780.465457][T25950] binder: 25948:25950 ioctl 401c5820 20000000 returned -22 [ 1780.466400][T25952] fuse: Bad value for 'fd' 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x18, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$pptp(0x18, 0x1, 0x2) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x8000, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000000000Q0140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB=',allow_other,max_read=0x0000000000000008,max_read=0x00000000000001ff,max_read=0x0000000000001000,mask=MAY_READ,\x00'], 0x0, 0x0, &(0x7f0000000200)="ec4ef4f7c18dfb185ef612837e8649a475937d4309aac005ceca6e77f530d22a38f957b98df7906c530837d991095da83c22a089b856351c530c6d54d93dd334701b8f93f7a82d2249fb752c303353ab4706a762a6146d1b80012a3359dd191cd7a35faa31fc887d") mknodat(r1, &(0x7f0000000280)='./file0\x00', 0x4, 0x63d17771) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) connect$bt_rfcomm(r2, &(0x7f0000000240), 0xa) write$P9_RMKNOD(r2, &(0x7f00000002c0)={0x14, 0x13, 0x2, {0x2, 0x2}}, 0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$pptp(0x18, 0x1, 0x2) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x8000, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=000000000000000Q0140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB=',allow_other,max_read=0x0000000000000008,max_read=0x00000000000001ff,max_read=0x0000000000001000,mask=MAY_READ,\x00'], 0x0, 0x0, &(0x7f0000000200)="ec4ef4f7c18dfb185ef612837e8649a475937d4309aac005ceca6e77f530d22a38f957b98df7906c530837d991095da83c22a089b856351c530c6d54d93dd334701b8f93f7a82d2249fb752c303353ab4706a762a6146d1b80012a3359dd191cd7a35faa31fc887d") (async) mknodat(r1, &(0x7f0000000280)='./file0\x00', 0x4, 0x63d17771) (async) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) (async) connect$bt_rfcomm(r2, &(0x7f0000000240), 0xa) (async) write$P9_RMKNOD(r2, &(0x7f00000002c0)={0x14, 0x13, 0x2, {0x2, 0x2}}, 0x14) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040630c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1780.491386][T25957] binder: 25955:25957 ioctl 40086602 20000000 returned -22 [ 1780.495425][T25959] binder: 25958:25959 ioctl 401c5820 20000000 returned -22 [ 1780.513132][T25966] binder: 25963:25966 ioctl 10 20000000 returned -22 [ 1780.520459][T25967] binder: 25964:25967 ioctl 401c5820 20000000 returned -22 [ 1780.540864][T25971] fuse: Bad value for 'fd' 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x800, 0x0) r2 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x0) io_setup(0x5, &(0x7f0000000880)=0x0) io_cancel(r3, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x3, 0x8000, r2, &(0x7f00000008c0)="83d9256a677a37b66753f7", 0xb, 0x2, 0x0, 0x1}, &(0x7f0000000940)) (async) utimensat(r2, 0x0, 0x0, 0x0) (async) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000680), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000740)={'gretap0\x00', &(0x7f0000000700)={'gretap0\x00', 0x0, 0x8, 0x8, 0x800, 0xbc0, {{0x8, 0x4, 0x1, 0x8, 0x20, 0x67, 0x0, 0x4, 0x29, 0x0, @loopback, @multicast2, {[@timestamp_addr={0x44, 0xc, 0xc6, 0x1, 0x4, [{@multicast2, 0x81}]}]}}}}}) (async) r7 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) read$char_usb(r7, &(0x7f00000001c0)=""/237, 0xed) (async) write$P9_RMKNOD(r7, &(0x7f0000000a80)={0x14, 0x13, 0x2, {0x1, 0x0, 0x5}}, 0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000840)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x60, r4, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x20512cbe}}, {0x8, 0x6, r6}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40}, 0x840) (async) r8 = io_uring_setup(0xa1b, &(0x7f0000000040)={0x0, 0xa45e, 0x20, 0x3, 0x3bd}) io_uring_register$IORING_REGISTER_PBUF_RING(r8, 0x16, &(0x7f0000000600)={&(0x7f0000001000)={[{&(0x7f00000000c0)="7a994b858f823fa5323a7a049bb4daced27c61d2a9936cea63a64ca88601e314576b684d1021c146ef594d13ea517964a7ac4c7cf7ff11", 0x37, 0x3}, {&(0x7f00000001c0)="fe67eeeabd82dfcde997468c2f3760dc9b184edd82a3ac20e58c0adaba63c246492446bca29a60f3fc528ce3d47bde7febfbba", 0x33, 0x2}, {&(0x7f0000000200)="11d1c04b02b00a540b65a6ad60a5e7fae4999949ff0501d8a8d9849d97de899ba604ab81e7334cfe19ffb98f7f8d22ab6d59f944d493a8d569e2051d24a6a8b351fe6cabcc66367ac33bc23399649c2bcb9babdfa0aa5f977b7253bfb4db041713855d261ed9454f479f7262d7f46899e7f4101f2f5796087d1054349d5580a31baf85497a26", 0x86}, {&(0x7f00000002c0)="4496ea2bdec6b765773c84946157564a1f4d7e86c671f3fa3352887765e6f31bd120d13fc407f0054cf036858b630d5bb620c21a563fd5c0663525f712e5eeb3c46228b8739e80a8db32fee456994355cba0ccde7d1496adda", 0x59}, {&(0x7f0000000340)="935693042c24815b3fe23e875c4764713d8bd4063d8c4cd28ea6051e6c713e530ac0912bfd17c6f42320f98f9d006b97edf62923223bf64cc18f174743167ea63b1c1f7806a3991ff1ac33b6", 0x4c}, {&(0x7f00000003c0)="0f2e84dbb9aa9c13419385561efea429b0f1fd983405fe35410b3b0b3cbdc0fdb2e2753308eb0808a04088ae79cf2a310be4a33c780885a1aef0f3a2857ccafa59407bf4f18b325d8e584f34df6d9755b06aeb460181704840a366be3727dd5a480bb8d5b1b6c3cb35ef08fabb2207b839e8dd13e040accac5878b9091d1d36e6bed3bf24d160ee1991a9d5a591238cdbb195c72ab", 0x95, 0x3}, {&(0x7f0000000480)="84438f0dcdb6d3fa16fe5f0cb64223603e34dc920220ab33", 0x18, 0x1}, {&(0x7f0000000500)="d4a389ebd3d93f6482f23d99845083b6f4cd39b125a070a542f57d130acb005d3aaf5031ef799b84e6ca79cccf432183569c497a098a5fa3ecf7beb9d8f9a0ebacd480af95156bc57cd88966d908df1b53708562cb7c5d5f434490aa2a644ad61096e493199f987f40103ce3e496459a4ac0feceaff0b48a8873d5ac93cfe4c08a71c5e8e5617fe582839b77ee5ed0187ee723a7438a9e095abe86aea2a959894acf8872cd1c1c27e04dc656b29a301afde7bcecc53c20f254c94e4a02c17a1a11dc46adc834bce9f5df21980ee127a20943bc", 0xd3, 0x2}]}, 0x8, 0x1}, 0x1) (async) getitimer(0x2, &(0x7f0000000a40)) r9 = syz_io_uring_complete(0x0) write$tun(0xffffffffffffffff, &(0x7f00000009c0)={@void, @val={0x1, 0x80, 0x4, 0x4, 0x2, 0x8}, @ipv4=@tipc={{0x11, 0x4, 0x0, 0x27, 0x6d, 0x68, 0x0, 0x1c, 0x6, 0x0, @empty, @empty, {[@end, @lsrr={0x83, 0x23, 0x7b, [@private=0xa010102, @private=0xa010101, @empty, @multicast1, @loopback, @local, @private=0xa010100, @loopback]}, @end, @rr={0x7, 0x7, 0x42, [@local]}, @ra={0x94, 0x4}]}}, @payload_named={{{{{0x29, 0x0, 0x0, 0x0, 0x1, 0xa, 0x3, 0x2, 0x5, 0x0, 0x1, 0x0, 0x3, 0x2, 0x5, 0x6, 0x1, 0x4e20, 0x4e24}, 0x0, 0x3}, 0x3, 0x3}}, [0x0]}}}, 0x77) syz_genetlink_get_family_id$batadv(&(0x7f0000000980), r9) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3c4000000) r10 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x13, r10, 0x10000000) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r10, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x25, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_procfs$userns(0x0, &(0x7f0000000280)) mount_setattr(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f00000002c0)={0x1000f3, 0x70, 0x120000, {r1}}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f00000000c0)={'syztnl2\x00', r2, 0x10, 0x10, 0x6, 0x9, {{0x3e, 0x4, 0x0, 0x3a, 0xf8, 0x65, 0x0, 0x20, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x20}, @multicast1, {[@ssrr={0x89, 0x1b, 0xd2, [@private=0xa010100, @remote, @dev={0xac, 0x14, 0x14, 0x16}, @dev={0xac, 0x14, 0x14, 0x1c}, @dev={0xac, 0x14, 0x14, 0x2d}, @multicast1]}, @timestamp_prespec={0x44, 0xc, 0x4f, 0x3, 0xc, [{@multicast1, 0x7}]}, @cipso={0x86, 0x5c, 0xffffffffffffffff, [{0x5, 0x9, "ab1679ff9efce3"}, {0x1, 0x11, "bc74ca86527d57bf232b2687007eef"}, {0x5, 0x11, "b15584b8fa0842b01823cae651aae2"}, {0x7, 0x12, "10c24abde56c2a6f2e127bde3eb2600c"}, {0x0, 0xb, "9bd5e244e95b49066b"}, {0x5, 0x7, "c836b701b9"}, {0x1, 0x7, "fec4739771"}]}, @timestamp_addr={0x44, 0x2c, 0xe4, 0x1, 0x1, [{@multicast2, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@multicast1, 0xfff}, {@loopback, 0x5}, {@private=0xa010100, 0x2b}]}, @timestamp={0x44, 0x14, 0xfa, 0x0, 0xd, [0x900000, 0x3f, 0xcb, 0x3f]}, @ssrr={0x89, 0x3, 0x3b}, @rr={0x7, 0x7, 0xc1, [@dev={0xac, 0x14, 0x14, 0x3e}]}, @timestamp_addr={0x44, 0x14, 0x3f, 0x1, 0x0, [{@empty, 0x1}, {@broadcast, 0x1}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.546660][T25973] binder: 25969:25973 ioctl 40086602 20000000 returned -22 [ 1780.548834][T25975] binder: 25974:25975 ioctl 401c5820 20000000 returned -22 [ 1780.561744][T25976] binder: 25972:25976 ioctl 4b47 20000000 returned -22 [ 1780.571029][T25978] binder: 25977:25978 ioctl 401c5820 20000000 returned -22 [ 1780.579899][T25985] fuse: Bad value for 'fd' 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_procfs$userns(0x0, &(0x7f0000000280)) mount_setattr(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f00000002c0)={0x1000f3, 0x70, 0x120000, {r1}}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f00000000c0)={'syztnl2\x00', r2, 0x10, 0x10, 0x6, 0x9, {{0x3e, 0x4, 0x0, 0x3a, 0xf8, 0x65, 0x0, 0x20, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x20}, @multicast1, {[@ssrr={0x89, 0x1b, 0xd2, [@private=0xa010100, @remote, @dev={0xac, 0x14, 0x14, 0x16}, @dev={0xac, 0x14, 0x14, 0x1c}, @dev={0xac, 0x14, 0x14, 0x2d}, @multicast1]}, @timestamp_prespec={0x44, 0xc, 0x4f, 0x3, 0xc, [{@multicast1, 0x7}]}, @cipso={0x86, 0x5c, 0xffffffffffffffff, [{0x5, 0x9, "ab1679ff9efce3"}, {0x1, 0x11, "bc74ca86527d57bf232b2687007eef"}, {0x5, 0x11, "b15584b8fa0842b01823cae651aae2"}, {0x7, 0x12, "10c24abde56c2a6f2e127bde3eb2600c"}, {0x0, 0xb, "9bd5e244e95b49066b"}, {0x5, 0x7, "c836b701b9"}, {0x1, 0x7, "fec4739771"}]}, @timestamp_addr={0x44, 0x2c, 0xe4, 0x1, 0x1, [{@multicast2, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@multicast1, 0xfff}, {@loopback, 0x5}, {@private=0xa010100, 0x2b}]}, @timestamp={0x44, 0x14, 0xfa, 0x0, 0xd, [0x900000, 0x3f, 0xcb, 0x3f]}, @ssrr={0x89, 0x3, 0x3b}, @rr={0x7, 0x7, 0xc1, [@dev={0xac, 0x14, 0x14, 0x3e}]}, @timestamp_addr={0x44, 0x14, 0x3f, 0x1, 0x0, [{@empty, 0x1}, {@broadcast, 0x1}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x48, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket(0x2a, 0x6, 0x80000001) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x5c, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7ff}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x80}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000000) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4c, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.594770][T25992] binder: 25991:25992 ioctl 401c5820 20000000 returned -22 [ 1780.604934][T25996] binder: 25993:25996 ioctl 40086602 20000000 returned -22 [ 1780.617651][T26001] binder: 25999:26001 ioctl 4b49 20000000 returned -22 [ 1780.624475][T26000] binder: 25998:26000 ioctl 401c5820 20000000 returned -22 [ 1780.632165][T26005] binder: 26004:26005 ioctl 401c5820 20000000 returned -22 [ 1780.635060][T26007] binder: 26003:26007 ioctl 40086602 20000000 returned -22 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_procfs$userns(0x0, &(0x7f0000000280)) mount_setattr(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f00000002c0)={0x1000f3, 0x70, 0x120000, {r1}}, 0x20) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f00000000c0)={'syztnl2\x00', r2, 0x10, 0x10, 0x6, 0x9, {{0x3e, 0x4, 0x0, 0x3a, 0xf8, 0x65, 0x0, 0x20, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x20}, @multicast1, {[@ssrr={0x89, 0x1b, 0xd2, [@private=0xa010100, @remote, @dev={0xac, 0x14, 0x14, 0x16}, @dev={0xac, 0x14, 0x14, 0x1c}, @dev={0xac, 0x14, 0x14, 0x2d}, @multicast1]}, @timestamp_prespec={0x44, 0xc, 0x4f, 0x3, 0xc, [{@multicast1, 0x7}]}, @cipso={0x86, 0x5c, 0xffffffffffffffff, [{0x5, 0x9, "ab1679ff9efce3"}, {0x1, 0x11, "bc74ca86527d57bf232b2687007eef"}, {0x5, 0x11, "b15584b8fa0842b01823cae651aae2"}, {0x7, 0x12, "10c24abde56c2a6f2e127bde3eb2600c"}, {0x0, 0xb, "9bd5e244e95b49066b"}, {0x5, 0x7, "c836b701b9"}, {0x1, 0x7, "fec4739771"}]}, @timestamp_addr={0x44, 0x2c, 0xe4, 0x1, 0x1, [{@multicast2, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@multicast1, 0xfff}, {@loopback, 0x5}, {@private=0xa010100, 0x2b}]}, @timestamp={0x44, 0x14, 0xfa, 0x0, 0xd, [0x900000, 0x3f, 0xcb, 0x3f]}, @ssrr={0x89, 0x3, 0x3b}, @rr={0x7, 0x7, 0xc1, [@dev={0xac, 0x14, 0x14, 0x3e}]}, @timestamp_addr={0x44, 0x14, 0x3f, 0x1, 0x0, [{@empty, 0x1}, {@broadcast, 0x1}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000500)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='sit0\x00'/16, @ANYRES32=0x0, @ANYBLOB="0080004a010068006700007f009078ac14141fe000000200700dac37514b89a5b8789a92e5014424d4900000000100000005000006f200000000000009770000eff6000000058000000794040100441cbca3ffffffff00000008e000000200000005ac1414bb0000000700"]}) socketpair(0x18, 0x6, 0x1f, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000600)=0x76) eventfd(0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x156}]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x20004040) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9ac}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x369f}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x840) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r2, @ANYRES32=r1]}) r4 = io_uring_setup(0x6e86, &(0x7f0000000400)={0x0, 0x3cfe, 0x800, 0x3, 0x16d}) sendmsg$BATADV_CMD_TP_METER(r3, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="9b7b2fcefd000225bd7000ffdbdf25020000000a000900aaaaaaaaaaaa000008002b0009000000050029"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x4, 0xfffffdfd, &(0x7f00000003c0)=[@register_looper], 0x0, 0x0, 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) io_setup(0x8, &(0x7f00000000c0)=0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x101042, 0x0) write$tun(r8, 0x0, 0x2bb) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x8, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000480)=[r0, r5, r3, r2, r6, r2], 0x6) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r1 = socket(0x2a, 0x6, 0x80000001) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x5c, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7ff}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x80}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000000) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1780.664524][T26011] binder: 26009:26011 ioctl 401c5820 200004c0 returned -22 [ 1780.674890][T26016] binder: 26013:26016 ioctl 401c5820 20000000 returned -22 [ 1780.680556][T26020] binder: 26012:26020 ioctl 40086602 20000000 returned -22 [ 1780.683063][T26021] binder: 26010:26021 ioctl 401c5820 20000000 returned -22 [ 1780.696839][T26015] binder: 26014:26015 ioctl 541b 20000000 returned -22 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000500)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='sit0\x00'/16, @ANYRES32=0x0, @ANYBLOB="0080004a010068006700007f009078ac14141fe000000200700dac37514b89a5b8789a92e5014424d4900000000100000005000006f200000000000009770000eff6000000058000000794040100441cbca3ffffffff00000008e000000200000005ac1414bb0000000700"]}) socketpair(0x18, 0x6, 0x1f, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000600)=0x76) (async, rerun: 32) eventfd(0x0) (async, rerun: 32) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x156}]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x20004040) (async) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9ac}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x369f}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x840) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r2, @ANYRES32=r1]}) (async, rerun: 32) r4 = io_uring_setup(0x6e86, &(0x7f0000000400)={0x0, 0x3cfe, 0x800, 0x3, 0x16d}) (async, rerun: 32) sendmsg$BATADV_CMD_TP_METER(r3, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="9b7b2fcefd000225bd7000ffdbdf25020000000a000900aaaaaaaaaaaa000008002b0009000000050029"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x4, 0xfffffdfd, &(0x7f00000003c0)=[@register_looper], 0x0, 0x0, 0x0}) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) io_setup(0x8, &(0x7f00000000c0)=0x0) (async) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x101042, 0x0) write$tun(r8, 0x0, 0x2bb) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x8, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000480)=[r0, r5, r3, r2, r6, r2], 0x6) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x68, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000500)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='sit0\x00'/16, @ANYRES32=0x0, @ANYBLOB="0080004a010068006700007f009078ac14141fe000000200700dac37514b89a5b8789a92e5014424d4900000000100000005000006f200000000000009770000eff6000000058000000794040100441cbca3ffffffff00000008e000000200000005ac1414bb0000000700"]}) socketpair(0x18, 0x6, 0x1f, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000600)=0x76) eventfd(0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x156}]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x20004040) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9ac}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x369f}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x840) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r2, @ANYRES32=r1]}) r4 = io_uring_setup(0x6e86, &(0x7f0000000400)={0x0, 0x3cfe, 0x800, 0x3, 0x16d}) sendmsg$BATADV_CMD_TP_METER(r3, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="9b7b2fcefd000225bd7000ffdbdf25020000000a000900aaaaaaaaaaaa000008002b0009000000050029"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x4, 0xfffffdfd, &(0x7f00000003c0)=[@register_looper], 0x0, 0x0, 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) io_setup(0x8, &(0x7f00000000c0)=0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x101042, 0x0) write$tun(r8, 0x0, 0x2bb) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x8, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000480)=[r0, r5, r3, r2, r6, r2], 0x6) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000500)={'erspan0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='sit0\x00'/16, @ANYRES32=0x0, @ANYBLOB="0080004a010068006700007f009078ac14141fe000000200700dac37514b89a5b8789a92e5014424d4900000000100000005000006f200000000000009770000eff6000000058000000794040100441cbca3ffffffff00000008e000000200000005ac1414bb0000000700"]}) (async) socketpair(0x18, 0x6, 0x1f, &(0x7f0000000180)) (async) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000600)=0x76) (async) eventfd(0x0) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x156}]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x20004040) (async) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x4c, 0x0, 0x300, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9ac}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x369f}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x840) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r2, @ANYRES32=r1]}) (async) io_uring_setup(0x6e86, &(0x7f0000000400)={0x0, 0x3cfe, 0x800, 0x3, 0x16d}) (async) sendmsg$BATADV_CMD_TP_METER(r3, &(0x7f00000005c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="9b7b2fcefd000225bd7000ffdbdf25020000000a000900aaaaaaaaaaaa000008002b0009000000050029"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x4, 0xfffffdfd, &(0x7f00000003c0)=[@register_looper], 0x0, 0x0, 0x0}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) io_setup(0x8, &(0x7f00000000c0)) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000001000), 0x101042, 0x0) (async) write$tun(r8, 0x0, 0x2bb) (async) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x8, r6, 0x0, 0x0, 0x0, 0x0, 0x2}]) (async) io_uring_register$IORING_REGISTER_FILES(r4, 0x2, &(0x7f0000000480)=[r0, r5, r3, r2, r6, r2], 0x6) (async) [ 1780.724797][T26026] binder: 26024:26026 ioctl 401c5820 20000000 returned -22 [ 1780.734598][T26031] binder: 26029:26031 ioctl 401c5820 20000000 returned -22 [ 1780.754457][T26028] binder: 26027:26028 ioctl 401c5820 200004c0 returned -22 [ 1780.764687][T26033] binder: 26032:26033 ioctl 40086602 20000000 returned -22 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6c, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket(0x2a, 0x6, 0x80000001) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x5c, r2, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xef5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7ff}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x80}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000040}, 0x20000000) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406318, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x145200, 0x8) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+60000}, {0x0, 0x2710}}, 0x100) [ 1780.770240][T26045] binder: 26040:26045 ioctl 401c5820 20000000 returned -22 [ 1780.784605][T26048] binder: 26047:26048 ioctl 401c5820 20000000 returned -22 [ 1780.787482][T26050] binder: 26049:26050 ioctl 40086602 20000000 returned -22 [ 1780.806614][T26055] binder: 26052:26055 ioctl 401c5820 200004c0 returned -22 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x74, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2400c085}, 0x488c0) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406325, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) (async) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2400c085}, 0x488c0) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7a, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.834429][T26078] binder: 26075:26078 ioctl 401c5820 20000000 returned -22 [ 1780.843877][T26081] binder: 26079:26081 ioctl 401c5820 200004c0 returned -22 [ 1780.847369][T26084] binder: 26083:26084 ioctl 40086602 20000000 returned -22 [ 1780.861183][T26082] binder: 26080:26082 ioctl 401c5820 20000000 returned -22 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x145200, 0x8) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+60000}, {0x0, 0x2710}}, 0x100) (async) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+60000}, {0x0, 0x2710}}, 0x100) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406348, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2400c085}, 0x488c0) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) (async) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x2, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2400c085}, 0x488c0) (async) [ 1780.887609][T26095] binder: 26094:26095 ioctl 401c5820 20000000 returned -22 [ 1780.890228][T26097] binder: 26096:26097 ioctl 401c5820 20000000 returned -22 [ 1780.904671][T26099] binder: 26098:26099 ioctl 40086602 20000000 returned -22 [ 1780.918471][T26102] binder: 26101:26102 ioctl 401c5820 200004c0 returned -22 [ 1780.923720][T26104] binder: 26103:26104 ioctl 401c5820 20000000 returned -22 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x300, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async, rerun: 32) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x145200, 0x8) (rerun: 32) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+60000}, {0x0, 0x2710}}, 0x100) 10:17:32 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) rt_sigsuspend(&(0x7f0000000000)={[0x4]}, 0x8) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="79797a746e6c30000000000003000000d22659ede5c2c2c89cddae4f4d1abb6678150e829041232109978174418edf9e3afeb2c17083e4aa2df49b5662af0f7a3ac3c6b0d28af7a5d716bff7c334ff8bb3f02c6db95a0328c39db790ee3e5979113acd57209d8d7552b7f588a580d47b1b9caa0c7a5f8662eeacb049653f52ab1214cd6b82ba47e5454c78bf18140862a4342e8f50adf1ac0f6d0408d76142be1befdbff72e9a3709b71165b6611b069be42c717172efd259cdba033891f56c705ffe7812e4b9ee1898ddba5d37806ca4fec0ddfac5afb4a64c1eeda6abe9722294c5fdb03cdfbae8d3bd5faef010e0ebbf55c2c7089018015e5e266565d5720a4d4bf", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046210, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.935106][T26107] binder: 26100:26107 ioctl 401c5820 20000000 returned -22 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040634c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086603, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.958356][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1780.967878][T26122] binder: 26116:26122 ioctl 40086602 20000000 returned -22 [ 1780.968395][T26123] binder: 26121:26123 ioctl 401c5820 20000000 returned -22 [ 1780.987143][T26128] binder: 26127:26128 ioctl 401c5820 20000000 returned -22 [ 1780.995584][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x500, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406368, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4008660a, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086618, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:32 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x600, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1780.999058][T26132] binder: 26131:26132 ioctl 40086603 20000000 returned -22 [ 1781.007436][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.021498][T26135] binder: 26133:26135 ioctl 40086602 20000000 returned -22 [ 1781.024857][T26138] binder: 26137:26138 ioctl 4008660a 20000000 returned -22 [ 1781.028789][T26136] binder: 26134:26136 ioctl 401c5820 20000000 returned -22 [ 1781.044393][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040636c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x700, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.058360][T26142] binder: 26140:26142 ioctl 40086602 20000000 returned -22 [ 1781.060180][T26143] binder: 26141:26143 ioctl 401c5820 20000000 returned -22 [ 1781.065444][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.079945][T26145] binder: 26144:26145 ioctl 40086618 20000000 returned -22 [ 1781.086026][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.094405][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x900, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086664, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406374, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1781.104980][T26148] binder: 26147:26148 ioctl 40086602 20000000 returned -22 [ 1781.112585][T26150] binder: 26146:26150 ioctl 401c5820 20000000 returned -22 [ 1781.113654][T26151] binder: 26149:26151 ioctl 401c5820 20000000 returned -22 [ 1781.128539][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.136330][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.141035][T26155] binder: 26152:26155 ioctl 401c5820 20000000 returned -22 [ 1781.143882][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x4040637a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.151009][T26154] binder: 26153:26154 ioctl 40086602 20000000 returned -22 [ 1781.158248][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.168058][T26157] binder: 26156:26157 ioctl 40086664 20000000 returned -22 [ 1781.190326][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.191672][T26160] binder: 26158:26160 ioctl 401c5820 20000000 returned -22 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xa00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.198135][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.211846][T26161] binder: 26159:26161 ioctl 401c5820 20000000 returned -22 [ 1781.220635][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.229210][T26163] binder: 26162:26163 ioctl 40087602 20000000 returned -22 [ 1781.234935][T26166] binder: 26164:26166 ioctl 40086602 20000000 returned -22 [ 1781.238282][T26167] binder: 26165:26167 ioctl 401c5820 20000000 returned -22 [ 1781.247035][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xb00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x400c620e, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406400, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.261871][T26169] binder: 26168:26169 ioctl 401c5820 20000000 returned -22 [ 1781.271663][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.278818][T26171] binder: 26170:26171 ioctl 40086602 20000000 returned -22 [ 1781.285677][T26175] binder: 26174:26175 ioctl 401c5820 20000000 returned -22 [ 1781.289822][T26176] binder: 26172:26176 ioctl 400c620e 20000000 returned -22 [ 1781.295676][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xc00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.304066][T26177] binder: 26173:26177 ioctl 401c5820 20000000 returned -22 [ 1781.313826][T26179] binder: 26178:26179 ioctl 401c5820 20000000 returned -22 [ 1781.321595][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.334397][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.341751][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.342920][T26182] binder: 26180:26182 ioctl 401c5820 20000000 returned -22 [ 1781.350542][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.361234][T26183] binder: 26181:26183 ioctl 40086602 20000000 returned -22 [ 1781.365878][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.377051][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.384141][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.391355][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.398891][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.406574][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.413891][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.421126][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.428354][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.435662][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.442993][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 [ 1781.450230][T26118] binder: 26117:26118 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) rt_sigsuspend(&(0x7f0000000000)={[0x4]}, 0x8) (async) rt_sigsuspend(&(0x7f0000000000)={[0x4]}, 0x8) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="79797a746e6c30000000000003000000d22659ede5c2c2c89cddae4f4d1abb6678150e829041232109978174418edf9e3afeb2c17083e4aa2df49b5662af0f7a3ac3c6b0d28af7a5d716bff7c334ff8bb3f02c6db95a0328c39db790ee3e5979113acd57209d8d7552b7f588a580d47b1b9caa0c7a5f8662eeacb049653f52ab1214cd6b82ba47e5454c78bf18140862a4342e8f50adf1ac0f6d0408d76142be1befdbff72e9a3709b71165b6611b069be42c717172efd259cdba033891f56c705ffe7812e4b9ee1898ddba5d37806ca4fec0ddfac5afb4a64c1eeda6abe9722294c5fdb03cdfbae8d3bd5faef010e0ebbf55c2c7089018015e5e266565d5720a4d4bf", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xd00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 5: getresgid(&(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) setregid(r0, r2) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getresgid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f0000000200)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs2/binder0\x00', 0x2, 0x0) setregid(r1, r4) r5 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)=@generic={&(0x7f00000000c0)='./file0\x00'}, 0x18) ioctl$BINDER_WRITE_READ(r3, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) r7 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380), 0x4) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, r6, 0x25, 0x0, @val=@netkit={@link_fd=r7}}, 0x40) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xe00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 5: getresgid(&(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) setregid(r0, r2) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getresgid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f0000000200)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs2/binder0\x00', 0x2, 0x0) setregid(r1, r4) r5 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)=@generic={&(0x7f00000000c0)='./file0\x00'}, 0x18) ioctl$BINDER_WRITE_READ(r3, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) r7 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380), 0x4) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, r6, 0x25, 0x0, @val=@netkit={@link_fd=r7}}, 0x40) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) (async) setregid(r0, r2) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) (async) getresgid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f0000000200)) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs2/binder0\x00', 0x2, 0x0) (async) setregid(r1, r4) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)=@generic={&(0x7f00000000c0)='./file0\x00'}, 0x18) (async) ioctl$BINDER_WRITE_READ(r3, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380), 0x4) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, r6, 0x25, 0x0, @val=@netkit={@link_fd=r7}}, 0x40) (async) 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406900, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.821902][T26189] binder: 26187:26189 ioctl 40086602 20000000 returned -22 [ 1781.827828][T26194] binder: 26190:26194 ioctl 401c5820 200004c0 returned -22 [ 1781.830803][T26195] binder: 26191:26195 ioctl 401c5820 20000000 returned -22 [ 1781.836880][T26196] binder: 26188:26196 ioctl 401c5820 20000000 returned -22 [ 1781.851162][T26193] binder: 26192:26193 ioctl 401c5820 20000000 returned -22 [ 1781.861989][T26201] binder: 26200:26201 ioctl 401c5820 200004c0 returned -22 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1100, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.874847][T26203] binder: 26202:26203 ioctl 40086602 20000000 returned -22 [ 1781.882895][T26205] binder: 26204:26205 ioctl 401c5820 20000000 returned -22 [ 1781.884611][T26207] binder: 26206:26207 ioctl 401c5820 20000000 returned -22 [ 1781.898778][T26210] binder: 26200:26210 ioctl 401c5820 200004c0 returned -22 [ 1781.911427][T26218] binder: 26217:26218 ioctl 40086602 20000000 returned -22 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406f00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1200, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 5: getresgid(&(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) setregid(r0, r2) (async, rerun: 64) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 64) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) (async) getresgid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f0000000200)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs2/binder0\x00', 0x2, 0x0) (async) setregid(r1, r4) (async) r5 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)=@generic={&(0x7f00000000c0)='./file0\x00'}, 0x18) ioctl$BINDER_WRITE_READ(r3, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) (async, rerun: 64) r7 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380), 0x4) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r5, r6, 0x25, 0x0, @val=@netkit={@link_fd=r7}}, 0x40) [ 1781.920241][T26221] binder: 26219:26221 ioctl 80086601 20000000 returned -22 [ 1781.926424][T26223] binder: 26222:26223 ioctl 401c5820 20000000 returned -22 [ 1781.930440][T26225] binder: 26224:26225 ioctl 401c5820 20000000 returned -22 [ 1781.951861][T26228] binder: 26226:26228 ioctl 80087601 20000000 returned -22 [ 1781.958968][T26231] binder: 26230:26231 ioctl 401c5820 20000000 returned -22 [ 1781.968469][T26233] binder: 26232:26233 ioctl 401c5820 20000000 returned -22 10:17:33 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x801c581f, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1800, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1781.975611][T26229] binder: 26227:26229 ioctl 40086602 20000000 returned -22 [ 1781.989740][T26240] binder: 26239:26240 ioctl 401c5820 20000000 returned -22 [ 1781.994883][T26242] binder: 26241:26242 ioctl 801c581f 20000000 returned -22 [ 1782.007620][T26244] binder: 26243:26244 ioctl 401c5820 200004c0 returned -22 [ 1782.013603][T26247] binder: 26246:26247 ioctl 40086602 20000000 returned -22 10:17:33 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40407000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x2500, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4800, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1782.016893][T26248] binder: 26245:26248 ioctl 401c5820 20000000 returned -22 [ 1782.041125][T26250] binder: 26249:26250 ioctl 401c5820 20000000 returned -22 [ 1782.042285][T26256] binder: 26253:26256 ioctl 40086602 20000000 returned -22 [ 1782.048355][T26254] binder: 26251:26254 ioctl 401c5820 200004c0 returned -22 10:17:34 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40407300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1782.080345][T26261] binder: 26258:26261 ioctl 40086602 20000000 returned -22 [ 1782.089519][T26264] binder: 26262:26264 ioctl 401c5820 20000000 returned -22 [ 1782.089531][T26265] binder: 26263:26265 ioctl 401c5820 20000000 returned -22 10:17:34 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) rt_sigsuspend(&(0x7f0000000000)={[0x4]}, 0x8) (async) rt_sigsuspend(&(0x7f0000000000)={[0x4]}, 0x8) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="79797a746e6c30000000000003000000d22659ede5c2c2c89cddae4f4d1abb6678150e829041232109978174418edf9e3afeb2c17083e4aa2df49b5662af0f7a3ac3c6b0d28af7a5d716bff7c334ff8bb3f02c6db95a0328c39db790ee3e5979113acd57209d8d7552b7f588a580d47b1b9caa0c7a5f8662eeacb049653f52ab1214cd6b82ba47e5454c78bf18140862a4342e8f50adf1ac0f6d0408d76142be1befdbff72e9a3709b71165b6611b069be42c717172efd259cdba033891f56c705ffe7812e4b9ee1898ddba5d37806ca4fec0ddfac5afb4a64c1eeda6abe9722294c5fdb03cdfbae8d3bd5faef010e0ebbf55c2c7089018015e5e266565d5720a4d4bf", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:34 executing program 5: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4c00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40407400, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc00c620f, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 5: r0 = io_uring_setup(0x4aca, &(0x7f0000000200)={0x0, 0x5ab8, 0x8, 0x2, 0x364}) r1 = eventfd(0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000280)=r1, 0x1) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) time(&(0x7f00000002c0)) syz_io_uring_setup(0x5727, &(0x7f0000000000)={0x0, 0xec55, 0x200, 0x1, 0x132}, &(0x7f0000000080), &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x60ff, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1782.684807][T26270] binder: 26268:26270 ioctl 40086602 20000000 returned -22 [ 1782.691567][T26276] binder: 26267:26276 ioctl 401c5820 200004c0 returned -22 [ 1782.701630][T26273] binder: 26272:26273 ioctl 401c5820 20000000 returned -22 [ 1782.708759][T26275] binder: 26274:26275 ioctl 401c5820 20000000 returned -22 [ 1782.710591][T26281] binder: 26280:26281 ioctl c00c620f 20000000 returned -22 [ 1782.725728][T26283] binder: 26282:26283 ioctl 401c5820 200004c0 returned -22 10:17:34 executing program 5: r0 = io_uring_setup(0x4aca, &(0x7f0000000200)={0x0, 0x5ab8, 0x8, 0x2, 0x364}) r1 = eventfd(0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000280)=r1, 0x1) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) time(&(0x7f00000002c0)) (async) time(&(0x7f00000002c0)) syz_io_uring_setup(0x5727, &(0x7f0000000000)={0x0, 0xec55, 0x200, 0x1, 0x132}, &(0x7f0000000080), &(0x7f00000000c0)) (async) syz_io_uring_setup(0x5727, &(0x7f0000000000)={0x0, 0xec55, 0x200, 0x1, 0x132}, &(0x7f0000000080), &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40407500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc00c6211, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6800, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 5: r0 = io_uring_setup(0x4aca, &(0x7f0000000200)={0x0, 0x5ab8, 0x8, 0x2, 0x364}) r1 = eventfd(0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000280)=r1, 0x1) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) time(&(0x7f00000002c0)) syz_io_uring_setup(0x5727, &(0x7f0000000000)={0x0, 0xec55, 0x200, 0x1, 0x132}, &(0x7f0000000080), &(0x7f00000000c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) io_uring_setup(0x4aca, &(0x7f0000000200)={0x0, 0x5ab8, 0x8, 0x2, 0x364}) (async) eventfd(0x0) (async) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000280)=r1, 0x1) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) time(&(0x7f00000002c0)) (async) syz_io_uring_setup(0x5727, &(0x7f0000000000)={0x0, 0xec55, 0x200, 0x1, 0x132}, &(0x7f0000000080), &(0x7f00000000c0)) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00', 0x2, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) 10:17:34 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40407800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1782.733392][T26285] binder: 26284:26285 ioctl 40086602 20000000 returned -22 [ 1782.745985][T26288] binder: 26287:26288 ioctl 401c5820 20000000 returned -22 [ 1782.759945][T26290] binder: 26286:26290 ioctl 401c5820 200004c0 returned -22 [ 1782.765521][T26295] binder: 26289:26295 ioctl 401c5820 20000000 returned -22 10:17:34 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6c00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000000)=""/223) r1 = io_uring_setup(0x2d27, &(0x7f00000001c0)={0x0, 0x262e, 0x40, 0x0, 0x90}) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000440)={0x4, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/187, 0xbb}, {&(0x7f0000000340)}, {&(0x7f0000000380)=""/5, 0x5}], &(0x7f0000000400)=[0x6, 0x7, 0x8001, 0xa4, 0x0]}, 0x20) [ 1782.779840][T26297] binder: 26293:26297 ioctl 40086602 20000000 returned -22 [ 1782.790443][T26300] binder: 26298:26300 ioctl 401c5820 200004c0 returned -22 [ 1782.791102][T26302] binder: 26299:26302 ioctl 401c5820 20000000 returned -22 [ 1782.814406][T26312] binder: 26310:26312 ioctl 40086602 20000000 returned -22 [ 1782.824315][T26315] binder: 26313:26315 ioctl 401c5820 20000000 returned -22 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7400, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40407a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000000)=""/223) r1 = io_uring_setup(0x2d27, &(0x7f00000001c0)={0x0, 0x262e, 0x40, 0x0, 0x90}) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000440)={0x4, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/187, 0xbb}, {&(0x7f0000000340)}, {&(0x7f0000000380)=""/5, 0x5}], &(0x7f0000000400)=[0x6, 0x7, 0x8001, 0xa4, 0x0]}, 0x20) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000000)=""/223) (async) io_uring_setup(0x2d27, &(0x7f00000001c0)={0x0, 0x262e, 0x40, 0x0, 0x90}) (async) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000440)={0x4, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/187, 0xbb}, {&(0x7f0000000340)}, {&(0x7f0000000380)=""/5, 0x5}], &(0x7f0000000400)=[0x6, 0x7, 0x8001, 0xa4, 0x0]}, 0x20) (async) 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7a00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1782.831145][T26318] binder: 26317:26318 ioctl 401c5820 200004c0 returned -22 [ 1782.832040][T26316] binder: 26314:26316 ioctl c018620c 20000000 returned -22 [ 1782.849345][T26320] binder: 26319:26320 ioctl 40086602 20000000 returned -22 [ 1782.867373][T26323] binder: 26322:26323 ioctl 401c5820 20000000 returned -22 [ 1782.875390][T26324] binder: 26321:26324 ioctl 401c5820 20000000 returned -22 10:17:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:34 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:34 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1782.884805][T26327] binder: 26326:26327 ioctl 40086602 20000000 returned -22 [ 1782.892653][T26330] binder: 26325:26330 ioctl 401c5820 200004c0 returned -22 [ 1782.902161][T26333] binder: 26325:26333 ioctl 401c5820 200004c0 returned -22 [ 1782.918898][T26343] binder: 26342:26343 ioctl 401c5820 20000000 returned -22 [ 1782.919449][T26344] binder: 26341:26344 ioctl 401c5820 20000000 returned -22 [ 1782.933605][T26340] binder: 26338:26340 ioctl 40086602 20000000 returned -22 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645032014006400201f294c436268ee51aa1ed31cbea18108e00d1a81e616c67f9779b520a17524c7"]}) 10:17:35 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000000)=""/223) (async) r1 = io_uring_setup(0x2d27, &(0x7f00000001c0)={0x0, 0x262e, 0x40, 0x0, 0x90}) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000440)={0x4, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f0000000280)=""/187, 0xbb}, {&(0x7f0000000340)}, {&(0x7f0000000380)=""/5, 0x5}], &(0x7f0000000400)=[0x6, 0x7, 0x8001, 0xa4, 0x0]}, 0x20) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x102, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x2000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x103, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645032014006400201f294c436268ee51aa1ed31cbea18108e00d1a81e616c67f9779b520a17524c7"]}) [ 1783.538865][T26347] binder: 26345:26347 ioctl 401c5820 20000000 returned -22 [ 1783.541922][T26350] binder: 26348:26350 ioctl 40086602 20000000 returned -22 [ 1783.547824][T26351] binder: 26349:26351 ioctl 40086602 20000000 returned -22 [ 1783.556589][T26354] binder: 26353:26354 ioctl 401c5820 20000000 returned -22 [ 1783.567187][T26352] binder: 26346:26352 ioctl 401c5820 200004c0 returned -22 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645032014006400201f294c436268ee51aa1ed31cbea18108e00d1a81e616c67f9779b520a17524c7"]}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x3000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x104, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1783.588612][T26358] binder: 26357:26358 ioctl 40086602 20000000 returned -22 [ 1783.598045][T26362] binder: 26360:26362 ioctl 401c5820 20000000 returned -22 [ 1783.607199][T26365] binder: 26364:26365 ioctl 401c5820 20000000 returned -22 [ 1783.616685][T26368] binder: 26367:26368 ioctl 40086602 20000000 returned -22 [ 1783.628121][T26372] binder: 26371:26372 ioctl 40086602 20000000 returned -22 10:17:35 executing program 5: r0 = syz_io_uring_setup(0x4f1, &(0x7f0000000000)={0x0, 0xa281, 0x1000, 0x2, 0x162}, &(0x7f0000000080), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000001c0), 0x1) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x105, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[]}) 10:17:35 executing program 5: r0 = syz_io_uring_setup(0x4f1, &(0x7f0000000000)={0x0, 0xa281, 0x1000, 0x2, 0x162}, &(0x7f0000000080), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000001c0), 0x1) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x106, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[]}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1783.628588][T26374] binder: 26373:26374 ioctl 401c5820 20000000 returned -22 [ 1783.649744][T26376] binder: 26375:26376 ioctl 40086602 20000000 returned -22 [ 1783.664173][T26378] binder: 26377:26378 ioctl 401c5820 200004c0 returned -22 [ 1783.664785][T26383] binder: 26382:26383 ioctl 401c5820 20000000 returned -22 [ 1783.678462][T26380] binder: 26379:26380 ioctl 40086602 20000000 returned -22 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x5000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'syztnl2\x00', &(0x7f00000001c0)=ANY=[]}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x107, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 5: r0 = syz_io_uring_setup(0x4f1, &(0x7f0000000000)={0x0, 0xa281, 0x1000, 0x2, 0x162}, &(0x7f0000000080), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f00000001c0), 0x1) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1783.692501][T26386] binder: 26385:26386 ioctl 40086602 20000000 returned -22 [ 1783.699001][T26391] binder: 26388:26391 ioctl 401c5820 200004c0 returned -22 [ 1783.707825][T26394] binder: 26393:26394 ioctl 401c5820 20000000 returned -22 [ 1783.722559][T26397] binder: 26396:26397 ioctl 40086602 20000000 returned -22 [ 1783.730471][T26400] binder: 26395:26400 ioctl 401c5820 20000000 returned -22 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000040)=ANY=[@ANYRESDEC=r0, @ANYRES8=r0, @ANYRES16=r0, @ANYRES16=r0]}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) r4 = syz_io_uring_complete(0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x4, 0x0, r2, 0x5, '\x00', r3, r4, 0x3, 0x2, 0x5}, 0x48) io_cancel(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x4c, r1, &(0x7f0000000200)="1a08efe2b964bf3266239d0f0ecb00bb0dc5783f3ffca9ddb1ce0a814f05e1f7c36847184bb06318e1d84eb6923f4de4eb418c1644dd15582818c6fd6670a2d5afd9c7d101e08bc76897a9af9f587bd101012769564e1179668b860de790a8fb48dc33a6", 0x64, 0x80000000, 0x0, 0x1, r4}, &(0x7f00000002c0)) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000000)=0x80000001) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000040)=ANY=[@ANYRESDEC=r0, @ANYRES8=r0, @ANYRES16=r0, @ANYRES16=r0]}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) (async) r4 = syz_io_uring_complete(0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x4, 0x0, r2, 0x5, '\x00', r3, r4, 0x3, 0x2, 0x5}, 0x48) (async) io_cancel(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x4c, r1, &(0x7f0000000200)="1a08efe2b964bf3266239d0f0ecb00bb0dc5783f3ffca9ddb1ce0a814f05e1f7c36847184bb06318e1d84eb6923f4de4eb418c1644dd15582818c6fd6670a2d5afd9c7d101e08bc76897a9af9f587bd101012769564e1179668b860de790a8fb48dc33a6", 0x64, 0x80000000, 0x0, 0x1, r4}, &(0x7f00000002c0)) (async) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000000)=0x80000001) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x108, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'tunl0\x00', &(0x7f0000000040)=ANY=[@ANYRESDEC=r0, @ANYRES8=r0, @ANYRES16=r0, @ANYRES16=r0]}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) r4 = syz_io_uring_complete(0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x4, 0x0, r2, 0x5, '\x00', r3, r4, 0x3, 0x2, 0x5}, 0x48) io_cancel(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x4c, r1, &(0x7f0000000200)="1a08efe2b964bf3266239d0f0ecb00bb0dc5783f3ffca9ddb1ce0a814f05e1f7c36847184bb06318e1d84eb6923f4de4eb418c1644dd15582818c6fd6670a2d5afd9c7d101e08bc76897a9af9f587bd101012769564e1179668b860de790a8fb48dc33a6", 0x64, 0x80000000, 0x0, 0x1, r4}, &(0x7f00000002c0)) (async) io_cancel(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x4c, r1, &(0x7f0000000200)="1a08efe2b964bf3266239d0f0ecb00bb0dc5783f3ffca9ddb1ce0a814f05e1f7c36847184bb06318e1d84eb6923f4de4eb418c1644dd15582818c6fd6670a2d5afd9c7d101e08bc76897a9af9f587bd101012769564e1179668b860de790a8fb48dc33a6", 0x64, 0x80000000, 0x0, 0x1, r4}, &(0x7f00000002c0)) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000000)=0x80000001) (async) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000000)=0x80000001) [ 1783.738444][T26403] binder: 26402:26403 ioctl 401c5820 200004c0 returned -22 [ 1783.749862][T26407] binder: 26406:26407 ioctl 401c5820 20000000 returned -22 [ 1783.756987][T26404] binder: 26399:26404 ioctl 40086602 20000000 returned -22 [ 1783.758823][T26410] binder: 26408:26410 ioctl 401c5820 20000000 returned -22 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1783.794708][T26416] binder: 26414:26416 ioctl 401c5820 200004c0 returned -22 [ 1783.802659][T26424] binder: 26423:26424 ioctl 401c5820 20000000 returned -22 [ 1783.805012][T26415] binder: 26413:26415 ioctl 40086602 20000000 returned -22 [ 1783.817162][T26421] binder: 26420:26421 ioctl 40086602 20000000 returned -22 [ 1783.833776][T26430] binder: 26429:26430 ioctl 401c5820 20000000 returned -22 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x109, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000280), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r8, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) socketpair(0x1e, 0x1, 0xfff, &(0x7f0000000340)) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000540)={&(0x7f0000000580)={0x158, r3, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r1}, {0x13c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r1}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x844}, 0x10090) r9 = io_uring_setup(0x4950, &(0x7f00000000c0)={0x0, 0x92b4, 0x4, 0x2, 0x7a}) io_uring_register$IORING_REGISTER_IOWQ_AFF(r9, 0x11, &(0x7f0000000140)="810c6d094ff2934355c9058fedc147f8003876c7a567fc1c53d5c843c5df254a8f809d681ff763f845453ecbea80dab721f40bb609e352c3138b8c7e7e574db0eb1535d8c77181d6b685640aa8f551d539a0de8b9feba5aa844a1703a6b75c576e6a2dddb04006fa710245d46bab977cf6e774856b52483232681dd7d36ffae65a7609fcedbae5b8bf89b2f9b9d5fdd1e945a9c5fc5da5def70ced9ea127c5e2d8f7793dcf81ad910325b13a16ccc76d38fbd2bb20db39cc51cb5642d3cb4a8bf6b5095bed22e3d96b765a487fd5", 0xce) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000280), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) (async) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r8, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) socketpair(0x1e, 0x1, 0xfff, &(0x7f0000000340)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000540)={&(0x7f0000000580)={0x158, r3, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r1}, {0x13c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r1}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x844}, 0x10090) r9 = io_uring_setup(0x4950, &(0x7f00000000c0)={0x0, 0x92b4, 0x4, 0x2, 0x7a}) io_uring_register$IORING_REGISTER_IOWQ_AFF(r9, 0x11, &(0x7f0000000140)="810c6d094ff2934355c9058fedc147f8003876c7a567fc1c53d5c843c5df254a8f809d681ff763f845453ecbea80dab721f40bb609e352c3138b8c7e7e574db0eb1535d8c77181d6b685640aa8f551d539a0de8b9feba5aa844a1703a6b75c576e6a2dddb04006fa710245d46bab977cf6e774856b52483232681dd7d36ffae65a7609fcedbae5b8bf89b2f9b9d5fdd1e945a9c5fc5da5def70ced9ea127c5e2d8f7793dcf81ad910325b13a16ccc76d38fbd2bb20db39cc51cb5642d3cb4a8bf6b5095bed22e3d96b765a487fd5", 0xce) [ 1783.833815][T26431] binder: 26428:26431 ioctl 401c5820 20000000 returned -22 [ 1783.857829][T26433] binder: 26432:26433 ioctl 40086602 20000000 returned -22 [ 1783.874031][T26441] binder: 26438:26441 ioctl 401c5820 20000000 returned -22 [ 1783.875133][T26435] binder: 26434:26435 ioctl 401c5820 200004c0 returned -22 [ 1783.881837][T26442] binder: 26436:26442 ioctl 40086602 20000000 returned -22 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000280), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r8, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) socketpair(0x1e, 0x1, 0xfff, &(0x7f0000000340)) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000540)={&(0x7f0000000580)={0x158, r3, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r1}, {0x13c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r1}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x844}, 0x10090) r9 = io_uring_setup(0x4950, &(0x7f00000000c0)={0x0, 0x92b4, 0x4, 0x2, 0x7a}) io_uring_register$IORING_REGISTER_IOWQ_AFF(r9, 0x11, &(0x7f0000000140)="810c6d094ff2934355c9058fedc147f8003876c7a567fc1c53d5c843c5df254a8f809d681ff763f845453ecbea80dab721f40bb609e352c3138b8c7e7e574db0eb1535d8c77181d6b685640aa8f551d539a0de8b9feba5aa844a1703a6b75c576e6a2dddb04006fa710245d46bab977cf6e774856b52483232681dd7d36ffae65a7609fcedbae5b8bf89b2f9b9d5fdd1e945a9c5fc5da5def70ced9ea127c5e2d8f7793dcf81ad910325b13a16ccc76d38fbd2bb20db39cc51cb5642d3cb4a8bf6b5095bed22e3d96b765a487fd5", 0xce) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$team(&(0x7f0000000280), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000002c0)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r8, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) socketpair(0x1e, 0x1, 0xfff, &(0x7f0000000340)) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000540)={&(0x7f0000000580)={0x158, r3, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r1}, {0x13c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r4}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r1}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x844}, 0x10090) (async) io_uring_setup(0x4950, &(0x7f00000000c0)={0x0, 0x92b4, 0x4, 0x2, 0x7a}) (async) io_uring_register$IORING_REGISTER_IOWQ_AFF(r9, 0x11, &(0x7f0000000140)="810c6d094ff2934355c9058fedc147f8003876c7a567fc1c53d5c843c5df254a8f809d681ff763f845453ecbea80dab721f40bb609e352c3138b8c7e7e574db0eb1535d8c77181d6b685640aa8f551d539a0de8b9feba5aa844a1703a6b75c576e6a2dddb04006fa710245d46bab977cf6e774856b52483232681dd7d36ffae65a7609fcedbae5b8bf89b2f9b9d5fdd1e945a9c5fc5da5def70ced9ea127c5e2d8f7793dcf81ad910325b13a16ccc76d38fbd2bb20db39cc51cb5642d3cb4a8bf6b5095bed22e3d96b765a487fd5", 0xce) (async) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x8000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x10a, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x9000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffecb, 0x0, &(0x7f0000000280)=[@release={0x40046306, 0x2}, @dead_binder_done, @register_looper, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/222, 0xde, 0x2, 0x17}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @decrefs={0x40046307, 0x1}], 0x8c, 0x0, &(0x7f0000000300)="bd344225289253a620bfe55452165e32b100756cc8d8d3939f61824f6ecabc377ad86803a9321d2a315fd93c2a97aa5ba02f6b60983ed490047604e7fd7c5dad3e7b963cd642f0a682ade776c32afd42bf7f2b4f6eb6e4fd9a860654576de8b275fbd132bae28ee8206adef14d5a0467651ba81160e1cc313af5ea3fe556de9a62dba40f72e69067d68074c5"}) [ 1783.907367][T26448] binder: 26447:26448 ioctl 401c5820 20000000 returned -22 [ 1783.912110][T26450] binder: 26449:26450 ioctl 40086602 20000000 returned -22 [ 1783.929360][T26454] binder: 26452:26454 ioctl 401c5820 20000000 returned -22 [ 1783.940805][T26466] binder: 26465:26466 ioctl 401c5820 200004c0 returned -22 [ 1783.949803][T26469] binder: 26468:26469 ioctl 40086602 20000000 returned -22 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x10b, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="00000000000010000000000000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:35 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xa000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="00000000000010000000000000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="00000000000010000000000000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) [ 1783.968425][T26473] binder: 26472:26473 ioctl 401c5820 20000000 returned -22 [ 1783.969973][T26475] binder: 26474:26475 ioctl 40086602 20000000 returned -22 [ 1783.976757][T26476] binder: 26471:26476 ioctl 401c5820 200004c0 returned -22 [ 1783.993270][T26478] binder: 26477:26478 ioctl 40086602 20000000 returned -22 [ 1783.994766][T26480] binder: 26470:26480 ioctl 401c5820 20000000 returned -22 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x10c, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:35 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000000600000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x88000) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000000c0)=""/224) 10:17:35 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000000600000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x88000) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000000c0)=""/224) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xb000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x10d, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1784.021004][T26488] binder: 26486:26488 ioctl 401c5820 20000000 returned -22 [ 1784.024157][T26489] binder: 26482:26489 ioctl 40086602 20000000 returned -22 [ 1784.045252][T26492] binder: 26491:26492 ioctl 40086602 20000000 returned -22 [ 1784.048320][T26494] binder: 26490:26494 ioctl 401c5820 20000000 returned -22 [ 1784.063008][T26497] binder: 26496:26497 ioctl 401c5820 20000000 returned -22 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000000600000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7, 0x88000) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000000c0)=""/224) (async) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f00000000c0)=""/224) 10:17:36 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) io_uring_setup(0x7131, &(0x7f0000000000)={0x0, 0x2c87, 0x40, 0x1, 0x89, 0x0, r0}) 10:17:36 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) (async, rerun: 64) io_uring_setup(0x7131, &(0x7f0000000000)={0x0, 0x2c87, 0x40, 0x1, 0x89, 0x0, r0}) (rerun: 64) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xc000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x10e, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1784.087352][T26504] binder: 26503:26504 ioctl 40086602 20000000 returned -22 [ 1784.094810][T26502] binder: 26501:26502 ioctl 40086602 20000000 returned -22 [ 1784.103786][T26506] binder: 26505:26506 ioctl 401c5820 20000000 returned -22 [ 1784.115130][T26511] binder: 26510:26511 ioctl 401c5820 20000000 returned -22 [ 1784.129716][T26519] binder: 26515:26519 ioctl 40086602 20000000 returned -22 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xd000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x111, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1784.144878][T26521] binder: 26520:26521 ioctl 401c5820 20000000 returned -22 [ 1784.152680][T26523] binder: 26522:26523 ioctl 40086602 20000000 returned -22 [ 1784.162095][T26525] binder: 26524:26525 ioctl 401c5820 20000000 returned -22 [ 1784.177415][T26527] binder: 26526:26527 ioctl 40086602 20000000 returned -22 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x112, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xe000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1784.192411][T26532] binder: 26528:26532 ioctl 401c5820 20000000 returned -22 [ 1784.192418][T26533] binder: 26530:26533 ioctl 40086602 20000000 returned -22 [ 1784.207468][T26531] binder: 26529:26531 ioctl 401c5820 20000000 returned -22 [ 1784.224724][T26538] binder: 26536:26538 ioctl 40086602 20000000 returned -22 [ 1784.232199][T26539] binder: 26537:26539 ioctl 401c5820 20000000 returned -22 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x10000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1784.239469][T26535] binder: 26534:26535 ioctl 40086602 20000000 returned -22 [ 1784.275305][T26542] binder: 26540:26542 ioctl 40086602 20000000 returned -22 [ 1784.277385][T26543] binder: 26541:26543 ioctl 401c5820 20000000 returned -22 10:17:36 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffecb, 0x0, &(0x7f0000000280)=[@release={0x40046306, 0x2}, @dead_binder_done, @register_looper, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/222, 0xde, 0x2, 0x17}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @decrefs={0x40046307, 0x1}], 0x8c, 0x0, &(0x7f0000000300)="bd344225289253a620bfe55452165e32b100756cc8d8d3939f61824f6ecabc377ad86803a9321d2a315fd93c2a97aa5ba02f6b60983ed490047604e7fd7c5dad3e7b963cd642f0a682ade776c32afd42bf7f2b4f6eb6e4fd9a860654576de8b275fbd132bae28ee8206adef14d5a0467651ba81160e1cc313af5ea3fe556de9a62dba40f72e69067d68074c5"}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x129, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x11000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) (async) io_uring_setup(0x7131, &(0x7f0000000000)={0x0, 0x2c87, 0x40, 0x1, 0x89, 0x0, r0}) 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x2, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x12000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @any, 0x7f}, 0xa) [ 1784.816398][T26547] binder: 26545:26547 ioctl 401c5820 20000000 returned -22 [ 1784.822635][T26552] binder: 26546:26552 ioctl 401c5820 200004c0 returned -22 [ 1784.827687][T26556] binder: 26555:26556 ioctl 40086602 20000000 returned -22 [ 1784.834595][T26551] binder: 26550:26551 ioctl 40086602 20000000 returned -22 [ 1784.837910][T26549] binder: 26548:26549 ioctl 401c5820 20000000 returned -22 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @any, 0x7f}, 0xa) 10:17:36 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffecb, 0x0, &(0x7f0000000280)=[@release={0x40046306, 0x2}, @dead_binder_done, @register_looper, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/222, 0xde, 0x2, 0x17}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @decrefs={0x40046307, 0x1}], 0x8c, 0x0, &(0x7f0000000300)="bd344225289253a620bfe55452165e32b100756cc8d8d3939f61824f6ecabc377ad86803a9321d2a315fd93c2a97aa5ba02f6b60983ed490047604e7fd7c5dad3e7b963cd642f0a682ade776c32afd42bf7f2b4f6eb6e4fd9a860654576de8b275fbd132bae28ee8206adef14d5a0467651ba81160e1cc313af5ea3fe556de9a62dba40f72e69067d68074c5"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffecb, 0x0, &(0x7f0000000280)=[@release={0x40046306, 0x2}, @dead_binder_done, @register_looper, @release={0x40046306, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/222, 0xde, 0x2, 0x17}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @decrefs={0x40046307, 0x1}], 0x8c, 0x0, &(0x7f0000000300)="bd344225289253a620bfe55452165e32b100756cc8d8d3939f61824f6ecabc377ad86803a9321d2a315fd93c2a97aa5ba02f6b60983ed490047604e7fd7c5dad3e7b963cd642f0a682ade776c32afd42bf7f2b4f6eb6e4fd9a860654576de8b275fbd132bae28ee8206adef14d5a0467651ba81160e1cc313af5ea3fe556de9a62dba40f72e69067d68074c5"}) (async) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x18000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x3, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @any, 0x7f}, 0xa) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, @any, 0x7f}, 0xa) (async) [ 1784.872806][T26564] binder: 26562:26564 ioctl 40086602 20000000 returned -22 [ 1784.875870][T26566] binder: 26561:26566 ioctl 401c5820 20000000 returned -22 [ 1784.890076][T26560] binder: 26559:26560 ioctl 40086602 20000000 returned -22 [ 1784.898644][T26568] binder: 26563:26568 ioctl 401c5820 20000000 returned -22 [ 1784.906209][T26571] binder: 26570:26571 ioctl 40086602 20000000 returned -22 [ 1784.916158][T26572] binder: 26569:26572 ioctl 401c5820 200004c0 returned -22 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x25000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x5, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00'}) socketpair(0x37, 0x4, 0x1ff, &(0x7f0000000000)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xff}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1c}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x8010) [ 1784.926923][T26577] binder: 26576:26577 ioctl 40086602 20000000 returned -22 [ 1784.935937][T26583] binder: 26578:26583 ioctl 401c5820 20000000 returned -22 [ 1784.946148][T26585] binder: 26584:26585 ioctl 40086602 20000000 returned -22 [ 1784.949954][T26587] binder: 26586:26587 ioctl 40086602 20000000 returned -22 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00'}) (async) socketpair(0x37, 0x4, 0x1ff, &(0x7f0000000000)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xff}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1c}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x8010) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x48000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1784.976568][T26592] binder: 26590:26592 ioctl 401c5820 20000000 returned -22 [ 1784.986690][T26594] binder: 26569:26594 ioctl 401c5820 200004c0 returned -22 [ 1784.997160][T26596] binder: 26595:26596 ioctl 401c5820 20000000 returned -22 [ 1784.999430][T26597] binder: 26591:26597 ioctl 40086602 20000000 returned -22 [ 1785.019194][T26601] binder: 26599:26601 ioctl 40086602 20000000 returned -22 10:17:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:36 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00'}) (async) socketpair(0x37, 0x4, 0x1ff, &(0x7f0000000000)={0xffffffffffffffff}) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xff}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1c}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x8010) 10:17:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4c000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1785.030353][T26604] binder: 26603:26604 ioctl 401c5820 20000000 returned -22 [ 1785.050336][T26606] binder: 26605:26606 ioctl 401c5820 20000000 returned -22 [ 1785.062483][T26609] binder: 26608:26609 ioctl 40086602 20000000 returned -22 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x68000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@ifindex=0x0, 0x13, 0x1, 0x100, &(0x7f0000000700)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000780), &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000780)={'sit0\x00', &(0x7f0000000840)={'erspan0\x00', r0, 0x7800, 0x10, 0x3ff, 0x1ff, {{0x10, 0x4, 0x2, 0x23, 0x40, 0x66, 0x0, 0x4, 0x4, 0x0, @broadcast, @local, {[@timestamp_prespec={0x44, 0x2c, 0xe8, 0x3, 0x6, [{@empty, 0x80}, {@private=0xa010100}, {@multicast1, 0x70}, {@empty, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000030000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000081) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000200)={0x444, 0x3f3, 0x200, 0x70bd26, 0x25dfdbfe, {0x3, 0x0, 0x21, [0x80000000, 0x4, 0xfffffff7, 0xe1, 0x573786ba, 0x9, 0x4, 0x9, 0x80, 0x5, 0xfffffffc, 0x3, 0x80000000, 0x81, 0x5, 0x5, 0x2, 0x1, 0x9, 0x6, 0x4, 0x9, 0x9, 0x9, 0x6, 0x7ff, 0x0, 0x5, 0x100, 0xffffffff, 0x1000, 0x9, 0x80000001, 0x61, 0x9, 0x401, 0xf4a, 0x7fffffff, 0xff, 0x1f, 0xfff, 0x2ff6, 0x8, 0x8000, 0x7, 0x8c7, 0x2, 0x4, 0x80, 0xe3f, 0x80000001, 0x8, 0x0, 0x0, 0x1f, 0x1, 0x0, 0x9b30, 0x3c5af8f6, 0x4, 0x3, 0x1, 0xfffffffc, 0x2], [0x1, 0x7fffffff, 0x2, 0x2, 0x9, 0x3, 0x80, 0x5, 0x1ff, 0x8, 0x3, 0x80000000, 0x2d39, 0x4, 0x4, 0x0, 0x3ff, 0x0, 0x8, 0x6, 0x7, 0x0, 0xfffffff8, 0x9, 0x0, 0x0, 0x6, 0x0, 0x80, 0xffff, 0x7fff, 0x0, 0x52aea73a, 0x8, 0x1fff3ca9, 0x6, 0x1, 0x8000, 0x6e1b, 0x10000, 0x8001, 0x4, 0x1f, 0x3, 0x0, 0x1000, 0xea3, 0x80, 0x800, 0xffff, 0x8000, 0xfffffffe, 0x7fff, 0x200, 0x8, 0x9, 0x7, 0x5, 0x1000, 0x1f, 0x6, 0x10000, 0x8, 0x81], [0x1, 0x8, 0x3, 0x6, 0x1, 0x3f, 0x4, 0x7000, 0x7, 0x5, 0x2, 0x730, 0x8, 0x81, 0xffff, 0x1e7, 0x2, 0x7, 0x0, 0x1, 0x5, 0x10001, 0x3, 0x8, 0x10000, 0x6, 0x7, 0x7fff, 0x140000, 0x80000000, 0x200, 0x7fff, 0x80000001, 0x5, 0x0, 0x0, 0x6, 0xf0000000, 0xaf53, 0x8, 0x0, 0x800, 0xc1e7, 0x8, 0x6, 0x5, 0x7f, 0x1, 0x8, 0x101, 0x2, 0x8, 0xfffffff8, 0x80000000, 0x9, 0x1f, 0x5, 0x4, 0x0, 0x100, 0x0, 0x4, 0x8000, 0x6], [0x597b, 0x1, 0x5, 0x4, 0x3, 0x3, 0x40000000, 0x7f, 0x5, 0x3ff, 0x8000, 0x7fff, 0x100, 0x717002b0, 0xc9bd, 0xb50, 0x100, 0x4, 0xd2, 0x1, 0x2a, 0x5, 0x40, 0x8001, 0x8, 0x8, 0x1, 0x20d6, 0x9, 0x4, 0xffffff2b, 0x6, 0x8001, 0x40, 0x5, 0x7f, 0xffff0000, 0x7, 0x0, 0x96, 0xfffffffd, 0x0, 0xfffffff9, 0x9, 0x1, 0x7f, 0x4, 0x1ff, 0x120000, 0x1, 0x8, 0xa8, 0x0, 0x6e, 0x8, 0x9, 0x6, 0x2ebc, 0x3f, 0x4, 0x23, 0x101, 0x5, 0x1], 0x23, ['\x00', '(*\'!$\x00', 'sit0\x00', '}/\\}.@&.\'#\x00', '&}[^+\\}\'\'^]\x00']}, ["", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x4000}, 0x20006800) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6c000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1785.077216][T26613] binder: 26612:26613 ioctl 40086602 20000000 returned -22 [ 1785.083893][T26616] binder: 26615:26616 ioctl 40086602 20000000 returned -22 [ 1785.089130][T26617] binder: 26614:26617 ioctl 401c5820 20000000 returned -22 [ 1785.112848][T26621] binder: 26620:26621 ioctl 401c5820 20000000 returned -22 [ 1785.119660][T26624] binder: 26623:26624 ioctl 401c5820 20000000 returned -22 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x74000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@ifindex=0x0, 0x13, 0x1, 0x100, &(0x7f0000000700)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000780), &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000780)={'sit0\x00', &(0x7f0000000840)={'erspan0\x00', r0, 0x7800, 0x10, 0x3ff, 0x1ff, {{0x10, 0x4, 0x2, 0x23, 0x40, 0x66, 0x0, 0x4, 0x4, 0x0, @broadcast, @local, {[@timestamp_prespec={0x44, 0x2c, 0xe8, 0x3, 0x6, [{@empty, 0x80}, {@private=0xa010100}, {@multicast1, 0x70}, {@empty, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000030000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000081) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000200)={0x444, 0x3f3, 0x200, 0x70bd26, 0x25dfdbfe, {0x3, 0x0, 0x21, [0x80000000, 0x4, 0xfffffff7, 0xe1, 0x573786ba, 0x9, 0x4, 0x9, 0x80, 0x5, 0xfffffffc, 0x3, 0x80000000, 0x81, 0x5, 0x5, 0x2, 0x1, 0x9, 0x6, 0x4, 0x9, 0x9, 0x9, 0x6, 0x7ff, 0x0, 0x5, 0x100, 0xffffffff, 0x1000, 0x9, 0x80000001, 0x61, 0x9, 0x401, 0xf4a, 0x7fffffff, 0xff, 0x1f, 0xfff, 0x2ff6, 0x8, 0x8000, 0x7, 0x8c7, 0x2, 0x4, 0x80, 0xe3f, 0x80000001, 0x8, 0x0, 0x0, 0x1f, 0x1, 0x0, 0x9b30, 0x3c5af8f6, 0x4, 0x3, 0x1, 0xfffffffc, 0x2], [0x1, 0x7fffffff, 0x2, 0x2, 0x9, 0x3, 0x80, 0x5, 0x1ff, 0x8, 0x3, 0x80000000, 0x2d39, 0x4, 0x4, 0x0, 0x3ff, 0x0, 0x8, 0x6, 0x7, 0x0, 0xfffffff8, 0x9, 0x0, 0x0, 0x6, 0x0, 0x80, 0xffff, 0x7fff, 0x0, 0x52aea73a, 0x8, 0x1fff3ca9, 0x6, 0x1, 0x8000, 0x6e1b, 0x10000, 0x8001, 0x4, 0x1f, 0x3, 0x0, 0x1000, 0xea3, 0x80, 0x800, 0xffff, 0x8000, 0xfffffffe, 0x7fff, 0x200, 0x8, 0x9, 0x7, 0x5, 0x1000, 0x1f, 0x6, 0x10000, 0x8, 0x81], [0x1, 0x8, 0x3, 0x6, 0x1, 0x3f, 0x4, 0x7000, 0x7, 0x5, 0x2, 0x730, 0x8, 0x81, 0xffff, 0x1e7, 0x2, 0x7, 0x0, 0x1, 0x5, 0x10001, 0x3, 0x8, 0x10000, 0x6, 0x7, 0x7fff, 0x140000, 0x80000000, 0x200, 0x7fff, 0x80000001, 0x5, 0x0, 0x0, 0x6, 0xf0000000, 0xaf53, 0x8, 0x0, 0x800, 0xc1e7, 0x8, 0x6, 0x5, 0x7f, 0x1, 0x8, 0x101, 0x2, 0x8, 0xfffffff8, 0x80000000, 0x9, 0x1f, 0x5, 0x4, 0x0, 0x100, 0x0, 0x4, 0x8000, 0x6], [0x597b, 0x1, 0x5, 0x4, 0x3, 0x3, 0x40000000, 0x7f, 0x5, 0x3ff, 0x8000, 0x7fff, 0x100, 0x717002b0, 0xc9bd, 0xb50, 0x100, 0x4, 0xd2, 0x1, 0x2a, 0x5, 0x40, 0x8001, 0x8, 0x8, 0x1, 0x20d6, 0x9, 0x4, 0xffffff2b, 0x6, 0x8001, 0x40, 0x5, 0x7f, 0xffff0000, 0x7, 0x0, 0x96, 0xfffffffd, 0x0, 0xfffffff9, 0x9, 0x1, 0x7f, 0x4, 0x1ff, 0x120000, 0x1, 0x8, 0xa8, 0x0, 0x6e, 0x8, 0x9, 0x6, 0x2ebc, 0x3f, 0x4, 0x23, 0x101, 0x5, 0x1], 0x23, ['\x00', '(*\'!$\x00', 'sit0\x00', '}/\\}.@&.\'#\x00', '&}[^+\\}\'\'^]\x00']}, ["", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x4000}, 0x20006800) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x8, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1785.124738][T26627] binder: 26626:26627 ioctl 40086602 20000000 returned -22 [ 1785.130211][T26625] binder: 26622:26625 ioctl 40086602 20000000 returned -22 [ 1785.161393][T26632] binder: 26630:26632 ioctl 401c5820 20000000 returned -22 [ 1785.164724][T26635] binder: 26628:26635 ioctl 401c5820 20000000 returned -22 10:17:37 executing program 1: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@ifindex=0x0, 0x13, 0x1, 0x100, &(0x7f0000000700)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000780), &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000780)={'sit0\x00', &(0x7f0000000840)={'erspan0\x00', r0, 0x7800, 0x10, 0x3ff, 0x1ff, {{0x10, 0x4, 0x2, 0x23, 0x40, 0x66, 0x0, 0x4, 0x4, 0x0, @broadcast, @local, {[@timestamp_prespec={0x44, 0x2c, 0xe8, 0x3, 0x6, [{@empty, 0x80}, {@private=0xa010100}, {@multicast1, 0x70}, {@empty, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000030000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000081) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000200)={0x444, 0x3f3, 0x200, 0x70bd26, 0x25dfdbfe, {0x3, 0x0, 0x21, [0x80000000, 0x4, 0xfffffff7, 0xe1, 0x573786ba, 0x9, 0x4, 0x9, 0x80, 0x5, 0xfffffffc, 0x3, 0x80000000, 0x81, 0x5, 0x5, 0x2, 0x1, 0x9, 0x6, 0x4, 0x9, 0x9, 0x9, 0x6, 0x7ff, 0x0, 0x5, 0x100, 0xffffffff, 0x1000, 0x9, 0x80000001, 0x61, 0x9, 0x401, 0xf4a, 0x7fffffff, 0xff, 0x1f, 0xfff, 0x2ff6, 0x8, 0x8000, 0x7, 0x8c7, 0x2, 0x4, 0x80, 0xe3f, 0x80000001, 0x8, 0x0, 0x0, 0x1f, 0x1, 0x0, 0x9b30, 0x3c5af8f6, 0x4, 0x3, 0x1, 0xfffffffc, 0x2], [0x1, 0x7fffffff, 0x2, 0x2, 0x9, 0x3, 0x80, 0x5, 0x1ff, 0x8, 0x3, 0x80000000, 0x2d39, 0x4, 0x4, 0x0, 0x3ff, 0x0, 0x8, 0x6, 0x7, 0x0, 0xfffffff8, 0x9, 0x0, 0x0, 0x6, 0x0, 0x80, 0xffff, 0x7fff, 0x0, 0x52aea73a, 0x8, 0x1fff3ca9, 0x6, 0x1, 0x8000, 0x6e1b, 0x10000, 0x8001, 0x4, 0x1f, 0x3, 0x0, 0x1000, 0xea3, 0x80, 0x800, 0xffff, 0x8000, 0xfffffffe, 0x7fff, 0x200, 0x8, 0x9, 0x7, 0x5, 0x1000, 0x1f, 0x6, 0x10000, 0x8, 0x81], [0x1, 0x8, 0x3, 0x6, 0x1, 0x3f, 0x4, 0x7000, 0x7, 0x5, 0x2, 0x730, 0x8, 0x81, 0xffff, 0x1e7, 0x2, 0x7, 0x0, 0x1, 0x5, 0x10001, 0x3, 0x8, 0x10000, 0x6, 0x7, 0x7fff, 0x140000, 0x80000000, 0x200, 0x7fff, 0x80000001, 0x5, 0x0, 0x0, 0x6, 0xf0000000, 0xaf53, 0x8, 0x0, 0x800, 0xc1e7, 0x8, 0x6, 0x5, 0x7f, 0x1, 0x8, 0x101, 0x2, 0x8, 0xfffffff8, 0x80000000, 0x9, 0x1f, 0x5, 0x4, 0x0, 0x100, 0x0, 0x4, 0x8000, 0x6], [0x597b, 0x1, 0x5, 0x4, 0x3, 0x3, 0x40000000, 0x7f, 0x5, 0x3ff, 0x8000, 0x7fff, 0x100, 0x717002b0, 0xc9bd, 0xb50, 0x100, 0x4, 0xd2, 0x1, 0x2a, 0x5, 0x40, 0x8001, 0x8, 0x8, 0x1, 0x20d6, 0x9, 0x4, 0xffffff2b, 0x6, 0x8001, 0x40, 0x5, 0x7f, 0xffff0000, 0x7, 0x0, 0x96, 0xfffffffd, 0x0, 0xfffffff9, 0x9, 0x1, 0x7f, 0x4, 0x1ff, 0x120000, 0x1, 0x8, 0xa8, 0x0, 0x6e, 0x8, 0x9, 0x6, 0x2ebc, 0x3f, 0x4, 0x23, 0x101, 0x5, 0x1], 0x23, ['\x00', '(*\'!$\x00', 'sit0\x00', '}/\\}.@&.\'#\x00', '&}[^+\\}\'\'^]\x00']}, ["", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x4000}, 0x20006800) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@ifindex, 0x13, 0x1, 0x100, &(0x7f0000000700)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000780), &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000780)={'sit0\x00', &(0x7f0000000840)={'erspan0\x00', r0, 0x7800, 0x10, 0x3ff, 0x1ff, {{0x10, 0x4, 0x2, 0x23, 0x40, 0x66, 0x0, 0x4, 0x4, 0x0, @broadcast, @local, {[@timestamp_prespec={0x44, 0x2c, 0xe8, 0x3, 0x6, [{@empty, 0x80}, {@private=0xa010100}, {@multicast1, 0x70}, {@empty, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000030000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x20000081) (async) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000680)={&(0x7f0000000200)={0x444, 0x3f3, 0x200, 0x70bd26, 0x25dfdbfe, {0x3, 0x0, 0x21, [0x80000000, 0x4, 0xfffffff7, 0xe1, 0x573786ba, 0x9, 0x4, 0x9, 0x80, 0x5, 0xfffffffc, 0x3, 0x80000000, 0x81, 0x5, 0x5, 0x2, 0x1, 0x9, 0x6, 0x4, 0x9, 0x9, 0x9, 0x6, 0x7ff, 0x0, 0x5, 0x100, 0xffffffff, 0x1000, 0x9, 0x80000001, 0x61, 0x9, 0x401, 0xf4a, 0x7fffffff, 0xff, 0x1f, 0xfff, 0x2ff6, 0x8, 0x8000, 0x7, 0x8c7, 0x2, 0x4, 0x80, 0xe3f, 0x80000001, 0x8, 0x0, 0x0, 0x1f, 0x1, 0x0, 0x9b30, 0x3c5af8f6, 0x4, 0x3, 0x1, 0xfffffffc, 0x2], [0x1, 0x7fffffff, 0x2, 0x2, 0x9, 0x3, 0x80, 0x5, 0x1ff, 0x8, 0x3, 0x80000000, 0x2d39, 0x4, 0x4, 0x0, 0x3ff, 0x0, 0x8, 0x6, 0x7, 0x0, 0xfffffff8, 0x9, 0x0, 0x0, 0x6, 0x0, 0x80, 0xffff, 0x7fff, 0x0, 0x52aea73a, 0x8, 0x1fff3ca9, 0x6, 0x1, 0x8000, 0x6e1b, 0x10000, 0x8001, 0x4, 0x1f, 0x3, 0x0, 0x1000, 0xea3, 0x80, 0x800, 0xffff, 0x8000, 0xfffffffe, 0x7fff, 0x200, 0x8, 0x9, 0x7, 0x5, 0x1000, 0x1f, 0x6, 0x10000, 0x8, 0x81], [0x1, 0x8, 0x3, 0x6, 0x1, 0x3f, 0x4, 0x7000, 0x7, 0x5, 0x2, 0x730, 0x8, 0x81, 0xffff, 0x1e7, 0x2, 0x7, 0x0, 0x1, 0x5, 0x10001, 0x3, 0x8, 0x10000, 0x6, 0x7, 0x7fff, 0x140000, 0x80000000, 0x200, 0x7fff, 0x80000001, 0x5, 0x0, 0x0, 0x6, 0xf0000000, 0xaf53, 0x8, 0x0, 0x800, 0xc1e7, 0x8, 0x6, 0x5, 0x7f, 0x1, 0x8, 0x101, 0x2, 0x8, 0xfffffff8, 0x80000000, 0x9, 0x1f, 0x5, 0x4, 0x0, 0x100, 0x0, 0x4, 0x8000, 0x6], [0x597b, 0x1, 0x5, 0x4, 0x3, 0x3, 0x40000000, 0x7f, 0x5, 0x3ff, 0x8000, 0x7fff, 0x100, 0x717002b0, 0xc9bd, 0xb50, 0x100, 0x4, 0xd2, 0x1, 0x2a, 0x5, 0x40, 0x8001, 0x8, 0x8, 0x1, 0x20d6, 0x9, 0x4, 0xffffff2b, 0x6, 0x8001, 0x40, 0x5, 0x7f, 0xffff0000, 0x7, 0x0, 0x96, 0xfffffffd, 0x0, 0xfffffff9, 0x9, 0x1, 0x7f, 0x4, 0x1ff, 0x120000, 0x1, 0x8, 0xa8, 0x0, 0x6e, 0x8, 0x9, 0x6, 0x2ebc, 0x3f, 0x4, 0x23, 0x101, 0x5, 0x1], 0x23, ['\x00', '(*\'!$\x00', 'sit0\x00', '}/\\}.@&.\'#\x00', '&}[^+\\}\'\'^]\x00']}, ["", ""]}, 0x444}, 0x1, 0x0, 0x0, 0x4000}, 0x20006800) (async) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000140)='./file0\x00', 0x421, &(0x7f00000005c0)=ANY=[@ANYBLOB="6664a8d1f8bc883d", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0xee00, @ANYBLOB=',group_id=', @ANYRESDEC, @ANYBLOB=',blksize=0x0000000000001400,allow_other,default_permissions,allow_other,blksize=0x0000000000000800,max_read=0x0000000000000007,allow_other,max_read=0x0000000000000000,allow_other,defcontext=unconfined_u,dirsync,smackfsroot=gretap0\x00,permit_directio,\x00'], 0x0, 0x0, &(0x7f0000000400)="96f3f91be40415901f8d017849d29e69e8a8755ba910cb113946a65f2fee8166892f947de9c0c29676df3217f3c01df0d476abfa6e9493fa05bffcd3edaa92304107ac2128a38ad2d176c8ca0257617d2be7589a7161cfb82fdd26ea420c0f171eb1e1f468f20c877592221558f7cfc7040acfcba6cab02c8edcb2db68f7f57a8e924edf6794996cb2a71f7fbc93917d332e76fc8822f0bcdf75ba854c24b83e62d2068bff91dbe5") clock_gettime(0x0, &(0x7f00000004c0)={0x0, 0x0}) futimesat(r1, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={{0x0, 0x2710}, {0x77359400}}) futimesat(r1, &(0x7f0000000180)='./file0\x00', &(0x7f0000000500)={{r2, r3/1000+60000}, {0x77359400}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f00000001c0)={'gretap0\x00', r4, 0x7800, 0x40, 0x8855, 0x10000, {{0x1b, 0x4, 0x1, 0x0, 0x6c, 0x67, 0x0, 0x5, 0x29, 0x0, @empty, @multicast2, {[@cipso={0x86, 0x20, 0x3, [{0x2, 0x4, "f0a9"}, {0x6, 0x5, "4a080e"}, {0x6, 0x11, "1e7af8d67adc5bc98b42983f5b3887"}]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x7, 0xf8, [@local]}, @ssrr={0x89, 0xf, 0x80, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x17, 0x8a, [@loopback, @loopback, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x15}, @dev={0xac, 0x14, 0x14, 0x1a}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) [ 1785.171054][T26637] binder: 26636:26637 ioctl 40086602 20000000 returned -22 [ 1785.184201][T26638] binder: 26629:26638 ioctl 40086602 20000000 returned -22 [ 1785.190108][T26640] binder: 26639:26640 ioctl 401c5820 20000000 returned -22 10:17:37 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x9, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7a000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000140)='./file0\x00', 0x421, &(0x7f00000005c0)=ANY=[@ANYBLOB="6664a8d1f8bc883d", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0xee00, @ANYBLOB=',group_id=', @ANYRESDEC, @ANYBLOB=',blksize=0x0000000000001400,allow_other,default_permissions,allow_other,blksize=0x0000000000000800,max_read=0x0000000000000007,allow_other,max_read=0x0000000000000000,allow_other,defcontext=unconfined_u,dirsync,smackfsroot=gretap0\x00,permit_directio,\x00'], 0x0, 0x0, &(0x7f0000000400)="96f3f91be40415901f8d017849d29e69e8a8755ba910cb113946a65f2fee8166892f947de9c0c29676df3217f3c01df0d476abfa6e9493fa05bffcd3edaa92304107ac2128a38ad2d176c8ca0257617d2be7589a7161cfb82fdd26ea420c0f171eb1e1f468f20c877592221558f7cfc7040acfcba6cab02c8edcb2db68f7f57a8e924edf6794996cb2a71f7fbc93917d332e76fc8822f0bcdf75ba854c24b83e62d2068bff91dbe5") (async) clock_gettime(0x0, &(0x7f00000004c0)={0x0, 0x0}) futimesat(r1, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={{0x0, 0x2710}, {0x77359400}}) (async, rerun: 64) futimesat(r1, &(0x7f0000000180)='./file0\x00', &(0x7f0000000500)={{r2, r3/1000+60000}, {0x77359400}}) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f00000001c0)={'gretap0\x00', r4, 0x7800, 0x40, 0x8855, 0x10000, {{0x1b, 0x4, 0x1, 0x0, 0x6c, 0x67, 0x0, 0x5, 0x29, 0x0, @empty, @multicast2, {[@cipso={0x86, 0x20, 0x3, [{0x2, 0x4, "f0a9"}, {0x6, 0x5, "4a080e"}, {0x6, 0x11, "1e7af8d67adc5bc98b42983f5b3887"}]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x7, 0xf8, [@local]}, @ssrr={0x89, 0xf, 0x80, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x17, 0x8a, [@loopback, @loopback, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x15}, @dev={0xac, 0x14, 0x14, 0x1a}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000140)='./file0\x00', 0x421, &(0x7f00000005c0)=ANY=[@ANYBLOB="6664a8d1f8bc883d", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0xee00, @ANYBLOB=',group_id=', @ANYRESDEC, @ANYBLOB=',blksize=0x0000000000001400,allow_other,default_permissions,allow_other,blksize=0x0000000000000800,max_read=0x0000000000000007,allow_other,max_read=0x0000000000000000,allow_other,defcontext=unconfined_u,dirsync,smackfsroot=gretap0\x00,permit_directio,\x00'], 0x0, 0x0, &(0x7f0000000400)="96f3f91be40415901f8d017849d29e69e8a8755ba910cb113946a65f2fee8166892f947de9c0c29676df3217f3c01df0d476abfa6e9493fa05bffcd3edaa92304107ac2128a38ad2d176c8ca0257617d2be7589a7161cfb82fdd26ea420c0f171eb1e1f468f20c877592221558f7cfc7040acfcba6cab02c8edcb2db68f7f57a8e924edf6794996cb2a71f7fbc93917d332e76fc8822f0bcdf75ba854c24b83e62d2068bff91dbe5") clock_gettime(0x0, &(0x7f00000004c0)={0x0, 0x0}) futimesat(r1, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={{0x0, 0x2710}, {0x77359400}}) futimesat(r1, &(0x7f0000000180)='./file0\x00', &(0x7f0000000500)={{r2, r3/1000+60000}, {0x77359400}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f00000001c0)={'gretap0\x00', r4, 0x7800, 0x40, 0x8855, 0x10000, {{0x1b, 0x4, 0x1, 0x0, 0x6c, 0x67, 0x0, 0x5, 0x29, 0x0, @empty, @multicast2, {[@cipso={0x86, 0x20, 0x3, [{0x2, 0x4, "f0a9"}, {0x6, 0x5, "4a080e"}, {0x6, 0x11, "1e7af8d67adc5bc98b42983f5b3887"}]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x7, 0xf8, [@local]}, @ssrr={0x89, 0xf, 0x80, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x17, 0x8a, [@loopback, @loopback, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x15}, @dev={0xac, 0x14, 0x14, 0x1a}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000140)='./file0\x00', 0x421, &(0x7f00000005c0)=ANY=[@ANYBLOB="6664a8d1f8bc883d", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0xee00, @ANYBLOB=',group_id=', @ANYRESDEC, @ANYBLOB=',blksize=0x0000000000001400,allow_other,default_permissions,allow_other,blksize=0x0000000000000800,max_read=0x0000000000000007,allow_other,max_read=0x0000000000000000,allow_other,defcontext=unconfined_u,dirsync,smackfsroot=gretap0\x00,permit_directio,\x00'], 0x0, 0x0, &(0x7f0000000400)="96f3f91be40415901f8d017849d29e69e8a8755ba910cb113946a65f2fee8166892f947de9c0c29676df3217f3c01df0d476abfa6e9493fa05bffcd3edaa92304107ac2128a38ad2d176c8ca0257617d2be7589a7161cfb82fdd26ea420c0f171eb1e1f468f20c877592221558f7cfc7040acfcba6cab02c8edcb2db68f7f57a8e924edf6794996cb2a71f7fbc93917d332e76fc8822f0bcdf75ba854c24b83e62d2068bff91dbe5") (async) clock_gettime(0x0, &(0x7f00000004c0)) (async) futimesat(r1, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={{0x0, 0x2710}, {0x77359400}}) (async) futimesat(r1, &(0x7f0000000180)='./file0\x00', &(0x7f0000000500)={{r2, r3/1000+60000}, {0x77359400}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'syztnl2\x00', &(0x7f00000001c0)={'gretap0\x00', r4, 0x7800, 0x40, 0x8855, 0x10000, {{0x1b, 0x4, 0x1, 0x0, 0x6c, 0x67, 0x0, 0x5, 0x29, 0x0, @empty, @multicast2, {[@cipso={0x86, 0x20, 0x3, [{0x2, 0x4, "f0a9"}, {0x6, 0x5, "4a080e"}, {0x6, 0x11, "1e7af8d67adc5bc98b42983f5b3887"}]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x7, 0xf8, [@local]}, @ssrr={0x89, 0xf, 0x80, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101]}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x17, 0x8a, [@loopback, @loopback, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x15}, @dev={0xac, 0x14, 0x14, 0x1a}]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) [ 1785.746620][T26655] binder: 26654:26655 ioctl 401c5820 20000000 returned -22 [ 1785.752167][T26660] binder: 26656:26660 ioctl 401c5820 20000000 returned -22 [ 1785.755448][T26661] binder: 26657:26661 ioctl 40086602 20000000 returned -22 [ 1785.761703][T26662] binder: 26653:26662 ioctl 40086602 20000000 returned -22 [ 1785.776001][T26664] binder: 26663:26664 ioctl 401c5820 200004c0 returned -22 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xff600000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xa, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r1) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) [ 1785.801923][T26670] binder: 26667:26670 ioctl 401c5820 20000000 returned -22 [ 1785.809114][T26673] binder: 26672:26673 ioctl 40086602 20000000 returned -22 [ 1785.810524][T26669] binder: 26668:26669 ioctl 401c5820 20000000 returned -22 [ 1785.823992][T26676] binder: 26675:26676 ioctl 40086602 20000000 returned -22 [ 1785.838121][T26685] binder: 26677:26685 ioctl 401c5820 200004c0 returned -22 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x60ffffffffff, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r1) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) (async) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r1) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xb, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) syz_genetlink_get_family_id$team(&(0x7f00000000c0), r1) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1785.847170][T26690] binder: 26677:26690 ioctl 401c5820 200004c0 returned -22 [ 1785.847454][T26689] binder: 26686:26689 ioctl 401c5820 20000000 returned -22 [ 1785.863353][T26693] binder: 26691:26693 ioctl 40086602 20000000 returned -22 [ 1785.884428][T26700] binder: 26699:26700 ioctl 401c5820 200004c0 returned -22 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xc, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYRESHEX=r0]}) 10:17:37 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xc0, 0x0, &(0x7f0000000340)=[@release={0x40046306, 0x1}, @acquire={0x40046305, 0x3}, @acquire_done={0x40106309, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@flat=@handle={0x73682a85, 0x10b}, @flat=@handle={0x73682a85, 0x1101, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/120, 0x78, 0x1, 0x3d}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x1000}, @register_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/91, 0x5b, 0x0, 0x27}, @fda={0x66646185, 0x0, 0x1, 0x6}, @fda={0x66646185, 0x4, 0x0, 0x9}}, &(0x7f0000000300)={0x0, 0x28, 0x48}}, 0x1000}], 0xaa, 0x0, &(0x7f0000000400)="239cacc551d327f41d995e0e46c61441b34c8087b993b1f4a76fd087ddb5691949a99be175bf1d81fb512ad6e1fef45da8de33e372949d2d011e24111ae5f2fb9ebba4dd5df0b232cd84a0e50e035064c33f7ff9bee852918ce1e2b8f4fad4a1da5c7511e0c3d2a8d745988968a0dbaea153a0d66183f375313c7933826918d86f1df3a7552a7fac420f0702eff4ac66bf93e72f29c764cc6d9333d98b01d06f643d452235f444a2372b"}) 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x100000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYRESHEX=r0]}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1785.897516][T26706] binder: 26705:26706 ioctl 40086602 20000000 returned -22 [ 1785.899599][T26708] binder: 26703:26708 ioctl 401c5820 20000000 returned -22 [ 1785.905057][T26704] binder: 26702:26704 ioctl 401c5820 20000000 returned -22 [ 1785.914507][T26709] binder: 26699:26709 ioctl 401c5820 200004c0 returned -22 [ 1785.928931][T26711] binder: 26710:26711 ioctl 40086602 20000000 returned -22 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x200000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYRESHEX=r0]}) 10:17:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xd, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000005c2694711d", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)={0x44, r3, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1a}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x2400c011}, 0x20000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000200)={'sit0\x00', r1, 0x8, 0x10, 0x7, 0x1, {{0x2f, 0x4, 0x3, 0x2c, 0xbc, 0x67, 0x0, 0x9, 0x4, 0x0, @multicast1, @private=0xa010101, {[@timestamp_prespec={0x44, 0x24, 0xb4, 0x3, 0x6, [{@empty, 0x9}, {@multicast1, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb31}, {@empty, 0x400}]}, @lsrr={0x83, 0x13, 0xd1, [@multicast1, @dev={0xac, 0x14, 0x14, 0x28}, @dev={0xac, 0x14, 0x14, 0x1b}, @broadcast]}, @cipso={0x86, 0x70, 0x3, [{0x0, 0xa, "21dc46c0fca10ea9"}, {0x5, 0xf, "49f18671d414ce3b28fd5f96ec"}, {0x7, 0x10, "e8852a4ddf7e831410a9fa663314"}, {0x0, 0xf, "2642a2d8a90db1df36359a7eda"}, {0x5, 0x12, "137ce817d1d7c97294c7297ce9c48fe8"}, {0x6, 0xe, "6ad21216bc8b8d8db583b891"}, {0x4, 0x12, "d8d360cd37be05529b90e09f5ff37f54"}]}]}}}}}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xc0, 0x0, &(0x7f0000000340)=[@release={0x40046306, 0x1}, @acquire={0x40046305, 0x3}, @acquire_done={0x40106309, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@flat=@handle={0x73682a85, 0x10b}, @flat=@handle={0x73682a85, 0x1101, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/120, 0x78, 0x1, 0x3d}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x1000}, @register_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/91, 0x5b, 0x0, 0x27}, @fda={0x66646185, 0x0, 0x1, 0x6}, @fda={0x66646185, 0x4, 0x0, 0x9}}, &(0x7f0000000300)={0x0, 0x28, 0x48}}, 0x1000}], 0xaa, 0x0, &(0x7f0000000400)="239cacc551d327f41d995e0e46c61441b34c8087b993b1f4a76fd087ddb5691949a99be175bf1d81fb512ad6e1fef45da8de33e372949d2d011e24111ae5f2fb9ebba4dd5df0b232cd84a0e50e035064c33f7ff9bee852918ce1e2b8f4fad4a1da5c7511e0c3d2a8d745988968a0dbaea153a0d66183f375313c7933826918d86f1df3a7552a7fac420f0702eff4ac66bf93e72f29c764cc6d9333d98b01d06f643d452235f444a2372b"}) 10:17:37 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x300000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1785.952729][T26718] binder: 26716:26718 ioctl 40086602 20000000 returned -22 [ 1785.962255][T26717] binder: 26714:26717 ioctl 401c5820 200004c0 returned -22 [ 1785.970558][T26723] binder: 26722:26723 ioctl 401c5820 20000000 returned -22 [ 1785.977693][T26721] binder: 26720:26721 ioctl 401c5820 20000000 returned -22 [ 1785.981422][T26726] binder: 26724:26726 ioctl 40086602 20000000 returned -22 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000005c2694711d", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)={0x44, r3, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1a}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x2400c011}, 0x20000000) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000200)={'sit0\x00', r1, 0x8, 0x10, 0x7, 0x1, {{0x2f, 0x4, 0x3, 0x2c, 0xbc, 0x67, 0x0, 0x9, 0x4, 0x0, @multicast1, @private=0xa010101, {[@timestamp_prespec={0x44, 0x24, 0xb4, 0x3, 0x6, [{@empty, 0x9}, {@multicast1, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb31}, {@empty, 0x400}]}, @lsrr={0x83, 0x13, 0xd1, [@multicast1, @dev={0xac, 0x14, 0x14, 0x28}, @dev={0xac, 0x14, 0x14, 0x1b}, @broadcast]}, @cipso={0x86, 0x70, 0x3, [{0x0, 0xa, "21dc46c0fca10ea9"}, {0x5, 0xf, "49f18671d414ce3b28fd5f96ec"}, {0x7, 0x10, "e8852a4ddf7e831410a9fa663314"}, {0x0, 0xf, "2642a2d8a90db1df36359a7eda"}, {0x5, 0x12, "137ce817d1d7c97294c7297ce9c48fe8"}, {0x6, 0xe, "6ad21216bc8b8d8db583b891"}, {0x4, 0x12, "d8d360cd37be05529b90e09f5ff37f54"}]}]}}}}}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:37 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30000000005c2694711d", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r2, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000380)={&(0x7f0000000140)={0x44, r3, 0x4, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1a}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x4}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x7ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x2400c011}, 0x20000000) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000200)={'sit0\x00', r1, 0x8, 0x10, 0x7, 0x1, {{0x2f, 0x4, 0x3, 0x2c, 0xbc, 0x67, 0x0, 0x9, 0x4, 0x0, @multicast1, @private=0xa010101, {[@timestamp_prespec={0x44, 0x24, 0xb4, 0x3, 0x6, [{@empty, 0x9}, {@multicast1, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xb31}, {@empty, 0x400}]}, @lsrr={0x83, 0x13, 0xd1, [@multicast1, @dev={0xac, 0x14, 0x14, 0x28}, @dev={0xac, 0x14, 0x14, 0x1b}, @broadcast]}, @cipso={0x86, 0x70, 0x3, [{0x0, 0xa, "21dc46c0fca10ea9"}, {0x5, 0xf, "49f18671d414ce3b28fd5f96ec"}, {0x7, 0x10, "e8852a4ddf7e831410a9fa663314"}, {0x0, 0xf, "2642a2d8a90db1df36359a7eda"}, {0x5, 0x12, "137ce817d1d7c97294c7297ce9c48fe8"}, {0x6, 0xe, "6ad21216bc8b8d8db583b891"}, {0x4, 0x12, "d8d360cd37be05529b90e09f5ff37f54"}]}]}}}}}) 10:17:37 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000001300)=ANY=[@ANYBLOB="baf28dea1688acc201f1c74eff1f99b0181aadf4f2dff97ca89a1d88ffc2993078a25bb2038775f5de5039b2155d431538b93bcf704040942ebf198f627be950605929e6758177b5ddb01110705c9a60a4648b90f60538d5db32846f32cdb0fd067cf9cce69ef9cc019c7b1dd32161c2b521fca0c7c8b3173466a698c5d2da683e2914cd2b2c2f55450ef0d1ae8cae2715d3a302561f85ac0d57fe0ca4225fb4232bfee48530ea69848398d5a31fabc6d774d2092ed7b00bf9f0f8085d8127776762e5a4ec4aa894040be38fe98939f307f0a7cc0e8c8ff9f6e4ad59d13d1cbd6685f67a3515b9a01257", @ANYRES32=r0, @ANYRESOCT=r0, @ANYRES8=r0, @ANYBLOB="bcf350191190561e102c92392d2a43040000002124a57fdb12937ec281faf12dd32af6881ac39e6a3dc08fae37b939826a54c98fedb999b0ebd3daadff6c8aa84a0f8776fd0000010038be9325c8c03d2d11cd7d494c56d89d3ba8244883a57740c6a482a27fcbea0100000000000000c43c1750b55ef0"]}) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0x754, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) r4 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x20c01) write$tun(r4, &(0x7f00000010c0)=ANY=[@ANYBLOB='W'], 0x53) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={@ifindex=r3, 0x0, 0x1, 0x0, &(0x7f0000001100)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000014c0)=[0x0]}, 0x40) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000480)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xa16e, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)}, 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@bloom_filter={0x1e, 0x25b1, 0x20, 0x5, 0x0, 0xffffffffffffffff, 0x872, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x2}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={0x1, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) r12 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x0) execveat(r12, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001180)=[&(0x7f0000001040)='\x00'], &(0x7f0000001200)=[&(0x7f00000011c0)='./+-}\x00'], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x14, &(0x7f0000001240)=ANY=[@ANYBLOB="18000000f8ffffff9100000000cc01000018110002", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000bf91000000000000b7020000020000008500000000000000b7000000000000009500000000000000"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x4, '\x00', r3, 0x25, r4, 0x8, &(0x7f0000000440)={0x5, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[r5, r6, 0xffffffffffffffff, r7, r8, r9, r10, r11, 0x1, r12], 0x0, 0x10, 0x6}, 0x90) [ 1786.013232][T26729] binder: 26728:26729 ioctl 40086602 20000000 returned -22 [ 1786.014197][T26734] binder: 26732:26734 ioctl 401c5820 200004c0 returned -22 [ 1786.027852][T26737] binder: 26736:26737 ioctl 401c5820 20000000 returned -22 [ 1786.036963][T26741] binder: 26739:26741 ioctl 401c5820 20000000 returned -22 [ 1786.037840][T26738] binder: 26733:26738 ioctl 40086602 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xe, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0xc0, 0x0, &(0x7f0000000340)=[@release={0x40046306, 0x1}, @acquire={0x40046305, 0x3}, @acquire_done={0x40106309, 0x1}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000080)={@flat=@handle={0x73682a85, 0x10b}, @flat=@handle={0x73682a85, 0x1101, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/120, 0x78, 0x1, 0x3d}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x1000}, @register_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/91, 0x5b, 0x0, 0x27}, @fda={0x66646185, 0x0, 0x1, 0x6}, @fda={0x66646185, 0x4, 0x0, 0x9}}, &(0x7f0000000300)={0x0, 0x28, 0x48}}, 0x1000}], 0xaa, 0x0, &(0x7f0000000400)="239cacc551d327f41d995e0e46c61441b34c8087b993b1f4a76fd087ddb5691949a99be175bf1d81fb512ad6e1fef45da8de33e372949d2d011e24111ae5f2fb9ebba4dd5df0b232cd84a0e50e035064c33f7ff9bee852918ce1e2b8f4fad4a1da5c7511e0c3d2a8d745988968a0dbaea153a0d66183f375313c7933826918d86f1df3a7552a7fac420f0702eff4ac66bf93e72f29c764cc6d9333d98b01d06f643d452235f444a2372b"}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x400000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x10, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.070042][T26750] binder: 26749:26750 ioctl 401c5820 20000000 returned -22 [ 1786.071790][T26751] binder: 26744:26751 ioctl 401c5820 20000000 returned -22 [ 1786.090047][T26756] binder: 26753:26756 ioctl 40086602 20000000 returned -22 [ 1786.094459][T26759] binder: 26754:26759 ioctl 40086602 20000000 returned -22 [ 1786.105471][T26758] binder: 26757:26758 ioctl 401c5820 200004c0 returned -22 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x500000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000001300)=ANY=[@ANYBLOB="baf28dea1688acc201f1c74eff1f99b0181aadf4f2dff97ca89a1d88ffc2993078a25bb2038775f5de5039b2155d431538b93bcf704040942ebf198f627be950605929e6758177b5ddb01110705c9a60a4648b90f60538d5db32846f32cdb0fd067cf9cce69ef9cc019c7b1dd32161c2b521fca0c7c8b3173466a698c5d2da683e2914cd2b2c2f55450ef0d1ae8cae2715d3a302561f85ac0d57fe0ca4225fb4232bfee48530ea69848398d5a31fabc6d774d2092ed7b00bf9f0f8085d8127776762e5a4ec4aa894040be38fe98939f307f0a7cc0e8c8ff9f6e4ad59d13d1cbd6685f67a3515b9a01257", @ANYRES32=r0, @ANYRESOCT=r0, @ANYRES8=r0, @ANYBLOB="bcf350191190561e102c92392d2a43040000002124a57fdb12937ec281faf12dd32af6881ac39e6a3dc08fae37b939826a54c98fedb999b0ebd3daadff6c8aa84a0f8776fd0000010038be9325c8c03d2d11cd7d494c56d89d3ba8244883a57740c6a482a27fcbea0100000000000000c43c1750b55ef0"]}) (async) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0x754, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) r4 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x20c01) write$tun(r4, &(0x7f00000010c0)=ANY=[@ANYBLOB='W'], 0x53) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={@ifindex=r3, 0x0, 0x1, 0x0, &(0x7f0000001100)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000014c0)=[0x0]}, 0x40) (async) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000480)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xa16e, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)}, 0x20) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@bloom_filter={0x1e, 0x25b1, 0x20, 0x5, 0x0, 0xffffffffffffffff, 0x872, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x2}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={0x1, 0xffffffffffffffff}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={0x1, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) (async) r12 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x0) execveat(r12, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001180)=[&(0x7f0000001040)='\x00'], &(0x7f0000001200)=[&(0x7f00000011c0)='./+-}\x00'], 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x14, &(0x7f0000001240)=ANY=[@ANYBLOB="18000000f8ffffff9100000000cc01000018110002", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000bf91000000000000b7020000020000008500000000000000b7000000000000009500000000000000"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x4, '\x00', r3, 0x25, r4, 0x8, &(0x7f0000000440)={0x5, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[r5, r6, 0xffffffffffffffff, r7, r8, r9, r10, r11, 0x1, r12], 0x0, 0x10, 0x6}, 0x90) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x11, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000001300)=ANY=[@ANYBLOB="baf28dea1688acc201f1c74eff1f99b0181aadf4f2dff97ca89a1d88ffc2993078a25bb2038775f5de5039b2155d431538b93bcf704040942ebf198f627be950605929e6758177b5ddb01110705c9a60a4648b90f60538d5db32846f32cdb0fd067cf9cce69ef9cc019c7b1dd32161c2b521fca0c7c8b3173466a698c5d2da683e2914cd2b2c2f55450ef0d1ae8cae2715d3a302561f85ac0d57fe0ca4225fb4232bfee48530ea69848398d5a31fabc6d774d2092ed7b00bf9f0f8085d8127776762e5a4ec4aa894040be38fe98939f307f0a7cc0e8c8ff9f6e4ad59d13d1cbd6685f67a3515b9a01257", @ANYRES32=r0, @ANYRESOCT=r0, @ANYRES8=r0, @ANYBLOB="bcf350191190561e102c92392d2a43040000002124a57fdb12937ec281faf12dd32af6881ac39e6a3dc08fae37b939826a54c98fedb999b0ebd3daadff6c8aa84a0f8776fd0000010038be9325c8c03d2d11cd7d494c56d89d3ba8244883a57740c6a482a27fcbea0100000000000000c43c1750b55ef0"]}) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0x754, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) r4 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x20c01) write$tun(r4, &(0x7f00000010c0)=ANY=[@ANYBLOB='W'], 0x53) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={@ifindex=r3, 0x0, 0x1, 0x0, &(0x7f0000001100)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000014c0)=[0x0]}, 0x40) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000480)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xa16e, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f0000000540)}, 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@bloom_filter={0x1e, 0x25b1, 0x20, 0x5, 0x0, 0xffffffffffffffff, 0x872, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x2}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={0x1, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) r12 = syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x0) execveat(r12, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001180)=[&(0x7f0000001040)='\x00'], &(0x7f0000001200)=[&(0x7f00000011c0)='./+-}\x00'], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x14, &(0x7f0000001240)=ANY=[@ANYBLOB="18000000f8ffffff9100000000cc01000018110002", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000bf91000000000000b7020000020000008500000000000000b7000000000000009500000000000000"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x4, '\x00', r3, 0x25, r4, 0x8, &(0x7f0000000440)={0x5, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[r5, r6, 0xffffffffffffffff, r7, r8, r9, r10, r11, 0x1, r12], 0x0, 0x10, 0x6}, 0x90) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000001300)=ANY=[@ANYBLOB="baf28dea1688acc201f1c74eff1f99b0181aadf4f2dff97ca89a1d88ffc2993078a25bb2038775f5de5039b2155d431538b93bcf704040942ebf198f627be950605929e6758177b5ddb01110705c9a60a4648b90f60538d5db32846f32cdb0fd067cf9cce69ef9cc019c7b1dd32161c2b521fca0c7c8b3173466a698c5d2da683e2914cd2b2c2f55450ef0d1ae8cae2715d3a302561f85ac0d57fe0ca4225fb4232bfee48530ea69848398d5a31fabc6d774d2092ed7b00bf9f0f8085d8127776762e5a4ec4aa894040be38fe98939f307f0a7cc0e8c8ff9f6e4ad59d13d1cbd6685f67a3515b9a01257", @ANYRES32=r0, @ANYRESOCT=r0, @ANYRES8=r0, @ANYBLOB="bcf350191190561e102c92392d2a43040000002124a57fdb12937ec281faf12dd32af6881ac39e6a3dc08fae37b939826a54c98fedb999b0ebd3daadff6c8aa84a0f8776fd0000010038be9325c8c03d2d11cd7d494c56d89d3ba8244883a57740c6a482a27fcbea0100000000000000c43c1750b55ef0"]}) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x2, 0x0, 0x1, 0x754, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x5}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)) (async) syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x20c01) (async) write$tun(r4, &(0x7f00000010c0)=ANY=[@ANYBLOB='W'], 0x53) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={@ifindex=r3, 0x0, 0x1, 0x0, &(0x7f0000001100)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000014c0)=[0x0]}, 0x40) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000480)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xa16e, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{0x1}, &(0x7f0000000500), &(0x7f0000000540)}, 0x20) (async) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@bloom_filter={0x1e, 0x25b1, 0x20, 0x5, 0x0, 0xffffffffffffffff, 0x872, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3, 0x2}, 0x48) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={0x1}, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680), 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000006c0)={0x1}, 0x4) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001080)={{}, &(0x7f0000000700), &(0x7f0000000740)}, 0x20) (async) syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x0) (async) execveat(r12, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001180)=[&(0x7f0000001040)='\x00'], &(0x7f0000001200)=[&(0x7f00000011c0)='./+-}\x00'], 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x14, &(0x7f0000001240)=ANY=[@ANYBLOB="18000000f8ffffff9100000000cc01000018110002", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000bf91000000000000b7020000020000008500000000000000b7000000000000009500000000000000"], &(0x7f00000003c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x4, '\x00', r3, 0x25, r4, 0x8, &(0x7f0000000440)={0x5, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=[r5, r6, 0xffffffffffffffff, r7, r8, r9, r10, r11, 0x1, r12], 0x0, 0x10, 0x6}, 0x90) (async) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) eventfd(0x5) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.116954][T26762] binder: 26761:26762 ioctl 401c5820 20000000 returned -22 [ 1786.118399][T26764] binder: 26763:26764 ioctl 40086602 20000000 returned -22 [ 1786.139163][T26769] binder: 26765:26769 ioctl 401c5820 20000000 returned -22 [ 1786.143934][T26774] binder: 26773:26774 ioctl 40086602 20000000 returned -22 [ 1786.160263][T26777] binder: 26776:26777 ioctl 40086602 20000000 returned -22 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) eventfd(0x5) (async) eventfd(0x5) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_io_uring_complete(0x0) write$P9_RAUTH(r1, &(0x7f0000000000)={0x14, 0x67, 0x2, {0x8, 0x1, 0x8}}, 0x14) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x600000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r1 = syz_io_uring_complete(0x0) write$P9_RAUTH(r1, &(0x7f0000000000)={0x14, 0x67, 0x2, {0x8, 0x1, 0x8}}, 0x14) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.174181][T26784] binder: 26782:26784 ioctl 401c5820 200004c0 returned -22 [ 1786.174498][T26785] binder: 26780:26785 ioctl 401c5820 20000000 returned -22 [ 1786.188415][T26778] binder: 26775:26778 ioctl 401c5820 20000000 returned -22 [ 1786.210966][T26806] binder: 26804:26806 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x12, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) eventfd(0x5) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_io_uring_complete(0x0) write$P9_RAUTH(r1, &(0x7f0000000000)={0x14, 0x67, 0x2, {0x8, 0x1, 0x8}}, 0x14) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x700000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.218269][T26809] binder: 26808:26809 ioctl 401c5820 200004c0 returned -22 [ 1786.225883][T26807] binder: 26805:26807 ioctl 40086602 20000000 returned -22 [ 1786.229569][T26811] binder: 26810:26811 ioctl 401c5820 20000000 returned -22 [ 1786.236037][T26814] binder: 26813:26814 ioctl 40086602 20000000 returned -22 [ 1786.263764][T26823] binder: 26822:26823 ioctl 40086602 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x18, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1786.265380][T26824] binder: 26818:26824 ioctl 401c5820 200004c0 returned -22 [ 1786.279674][T26829] binder: 26821:26829 ioctl 401c5820 20000000 returned -22 [ 1786.281122][T26830] binder: 26828:26830 ioctl 40086602 20000000 returned -22 [ 1786.298088][T26832] binder: 26831:26832 ioctl 401c5820 20000000 returned -22 [ 1786.313104][T26836] binder: 26835:26836 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x4, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000005}, 0x40080) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x25, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x1, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) write$tun(r1, 0x0, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x7}, 0x4) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x900000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x4, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000005}, 0x40080) [ 1786.332605][T26841] binder: 26839:26841 ioctl 40086602 20000000 returned -22 [ 1786.337224][T26845] binder: 26843:26845 ioctl 401c5820 20000000 returned -22 [ 1786.351840][T26849] binder: 26847:26849 ioctl 40086602 20000000 returned -22 [ 1786.369676][T26855] binder: 26854:26855 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x48, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r2, 0x4, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000005}, 0x40080) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xa00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) write$tun(r1, 0x0, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x7}, 0x4) [ 1786.380159][T26858] binder: 26856:26858 ioctl 40086602 20000000 returned -22 [ 1786.382776][T26861] binder: 26860:26861 ioctl 401c5820 20000000 returned -22 [ 1786.395531][T26859] binder: 26857:26859 ioctl 401c5820 200004c0 returned -22 [ 1786.402851][T26866] binder: 26865:26866 ioctl 40086602 20000000 returned -22 [ 1786.415282][T26868] binder: 26867:26868 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4c, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="79797a746e6c1d0e2e30000000000000000000", @ANYRES16=r0, @ANYRES8=r0]}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xb00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="79797a746e6c1d0e2e30000000000000000000", @ANYRES16=r0, @ANYRES8=r0]}) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="79797a746e6c1d0e2e30000000000000000000", @ANYRES16=r0, @ANYRES8=r0]}) (async) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x402, 0x0) write$tun(r1, 0x0, 0x0) (async) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000000)={0x7}, 0x4) [ 1786.427504][T26874] binder: 26869:26874 ioctl 40086602 20000000 returned -22 [ 1786.432300][T26875] binder: 26873:26875 ioctl 401c5820 200004c0 returned -22 [ 1786.442531][T26878] binder: 26876:26878 ioctl 401c5820 20000000 returned -22 [ 1786.459038][T26881] binder: 26880:26881 ioctl 40086602 20000000 returned -22 [ 1786.462346][T26884] binder: 26883:26884 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="79797a746e6c1d0e2e30000000000000000000", @ANYRES16=r0, @ANYRES8=r0]}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xc00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x68, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="797980746e6c30000000000000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl1\x00', r1, 0x7, 0x7820, 0x6, 0x401, {{0xa, 0x4, 0x2, 0x5, 0x28, 0x64, 0x0, 0x1, 0x4, 0x0, @empty, @rand_addr=0x64010101, {[@rr={0x7, 0x13, 0x3e, [@multicast2, @multicast1, @private=0xa010102, @loopback]}]}}}}}) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x20, 0x0, 0x1, 0x8, '\x00', r1, 0xffffffffffffffff, 0x0, 0x1}, 0x48) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x420bb08f, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x5, 0x5, 0x3}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)}, 0x20) r7 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x610a00) syz_mount_image$fuse(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=0000000000000000010d'], 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x13, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@btf_id={0x18, 0x7, 0x3, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x8d, &(0x7f0000000280)=""/141, 0x41000, 0x10, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0x2, 0x3424}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000600)=[r3, r4, r5, r6, 0x1, r7], &(0x7f0000000640)=[{0x0, 0x2, 0x4, 0x7}, {0x4, 0x1, 0xe, 0x2}, {0x2, 0x2, 0x0, 0xa}, {0x2, 0x3, 0x10, 0x6}, {0x2, 0x1, 0x5, 0x3}, {0x2, 0x2, 0x3, 0xa}, {0x4, 0x4, 0x2, 0x2}, {0x3, 0x5, 0x7, 0x6}], 0x10, 0x40}, 0x90) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.482489][T26888] binder: 26887:26888 ioctl 401c5820 200004c0 returned -22 [ 1786.482880][T26890] binder: 26885:26890 ioctl 40086602 20000000 returned -22 [ 1786.499876][T26894] binder: 26886:26894 ioctl 401c5820 20000000 returned -22 [ 1786.513138][T26898] binder: 26897:26898 ioctl 401c5820 20000000 returned -22 [ 1786.518624][T26903] binder: 26902:26903 ioctl 40086602 20000000 returned -22 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xd00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffff945) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x404) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x7920, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1, r2, 0x2, 0x4, 0x4}, 0x48) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x4) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="797980746e6c30000000000000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl1\x00', r1, 0x7, 0x7820, 0x6, 0x401, {{0xa, 0x4, 0x2, 0x5, 0x28, 0x64, 0x0, 0x1, 0x4, 0x0, @empty, @rand_addr=0x64010101, {[@rr={0x7, 0x13, 0x3e, [@multicast2, @multicast1, @private=0xa010102, @loopback]}]}}}}}) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x20, 0x0, 0x1, 0x8, '\x00', r1, 0xffffffffffffffff, 0x0, 0x1}, 0x48) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) (async) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x420bb08f, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x5, 0x5, 0x3}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)}, 0x20) (async) r7 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x610a00) syz_mount_image$fuse(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=0000000000000000010d'], 0x0, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x13, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@btf_id={0x18, 0x7, 0x3, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x8d, &(0x7f0000000280)=""/141, 0x41000, 0x10, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0x2, 0x3424}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000600)=[r3, r4, r5, r6, 0x1, r7], &(0x7f0000000640)=[{0x0, 0x2, 0x4, 0x7}, {0x4, 0x1, 0xe, 0x2}, {0x2, 0x2, 0x0, 0xa}, {0x2, 0x3, 0x10, 0x6}, {0x2, 0x1, 0x5, 0x3}, {0x2, 0x2, 0x3, 0xa}, {0x4, 0x4, 0x2, 0x2}, {0x3, 0x5, 0x7, 0x6}], 0x10, 0x40}, 0x90) [ 1786.532259][T26896] binder: 26895:26896 ioctl 40086602 20000000 returned -22 [ 1786.540863][T26906] binder: 26905:26906 ioctl 401c5820 20000000 returned -22 [ 1786.550228][T26910] fuse: Bad value for 'fd' [ 1786.550501][T26911] binder: 26908:26911 ioctl 401c5820 200004c0 returned -22 [ 1786.563353][T26912] binder: 26907:26912 ioctl 40086602 20000000 returned -22 [ 1786.569803][T26914] binder: 26913:26914 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6c, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 32) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffff945) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x404) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x7920, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1, r2, 0x2, 0x4, 0x4}, 0x48) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) r3 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, 0x0, 0x0) (async) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x4) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xe00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1000000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="797980746e6c30000000000000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl1\x00', r1, 0x7, 0x7820, 0x6, 0x401, {{0xa, 0x4, 0x2, 0x5, 0x28, 0x64, 0x0, 0x1, 0x4, 0x0, @empty, @rand_addr=0x64010101, {[@rr={0x7, 0x13, 0x3e, [@multicast2, @multicast1, @private=0xa010102, @loopback]}]}}}}}) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x20, 0x0, 0x1, 0x8, '\x00', r1, 0xffffffffffffffff, 0x0, 0x1}, 0x48) (async) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000440)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) (async) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x420bb08f, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1, 0xffffffffffffffff, 0x5, 0x5, 0x3}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)}, 0x20) (async) r7 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x610a00) syz_mount_image$fuse(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r7, @ANYBLOB=',rootmode=0000000000000000010d'], 0x0, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x13, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@btf_id={0x18, 0x7, 0x3, 0x0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x8d, &(0x7f0000000280)=""/141, 0x41000, 0x10, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0x2, 0x3424}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000600)=[r3, r4, r5, r6, 0x1, r7], &(0x7f0000000640)=[{0x0, 0x2, 0x4, 0x7}, {0x4, 0x1, 0xe, 0x2}, {0x2, 0x2, 0x0, 0xa}, {0x2, 0x3, 0x10, 0x6}, {0x2, 0x1, 0x5, 0x3}, {0x2, 0x2, 0x3, 0xa}, {0x4, 0x4, 0x2, 0x2}, {0x3, 0x5, 0x7, 0x6}], 0x10, 0x40}, 0x90) [ 1786.583594][T26916] binder: 26915:26916 ioctl 401c5820 20000000 returned -22 [ 1786.602297][T26923] binder: 26922:26923 ioctl 40086602 20000000 returned -22 [ 1786.604309][T26920] binder: 26917:26920 ioctl 40086602 20000000 returned -22 [ 1786.615222][T26926] binder: 26921:26926 ioctl 401c5820 200004c0 returned -22 [ 1786.619897][T26932] binder: 26924:26932 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0xfffffffffffff945) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) (async) r2 = syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x404) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x7920, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1, r2, 0x2, 0x4, 0x4}, 0x48) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x4) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1100000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031020000000645032316006400201f293f77af6b25c04bc512ce33d19e5373570351a2489d31fbecc1149ccf2f49"]}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x24000, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000000c0)) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x74, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.637006][T26936] binder: 26935:26936 ioctl 401c5820 20000000 returned -22 [ 1786.643345][T26938] binder: 26937:26938 ioctl 40086602 20000000 returned -22 [ 1786.650102][T26941] binder: 26939:26941 ioctl 401c5820 200004c0 returned -22 [ 1786.661956][T26947] binder: 26945:26947 ioctl 40086602 20000000 returned -22 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1200000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7a, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031020000000645032316006400201f293f77af6b25c04bc512ce33d19e5373570351a2489d31fbecc1149ccf2f49"]}) (async) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x24000, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000000c0)) [ 1786.681096][T26957] binder: 26952:26957 ioctl 40086602 20000000 returned -22 [ 1786.690446][T26955] binder: 26953:26955 ioctl 401c5820 200004c0 returned -22 [ 1786.701393][T26961] binder: 26960:26961 ioctl 401c5820 20000000 returned -22 [ 1786.709927][T26959] binder: 26958:26959 ioctl 401c5820 20000000 returned -22 [ 1786.724250][T26964] binder: 26962:26964 ioctl 40086602 20000000 returned -22 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031020000000645032316006400201f293f77af6b25c04bc512ce33d19e5373570351a2489d31fbecc1149ccf2f49"]}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x24000, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000000c0)) (async) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000000c0)) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x300, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: memfd_create(&(0x7f0000000040)='{:)!+\x00', 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) io_cancel(0x0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, r1, &(0x7f0000000540)}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB="00000080ff0031f10000000645030014006400201f2973efe8507c9401f28b08"]}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.735261][T26966] binder: 26965:26966 ioctl 40086602 20000000 returned -22 [ 1786.737899][T26967] binder: 26963:26967 ioctl 401c5820 200004c0 returned -22 [ 1786.761647][T26973] binder: 26972:26973 ioctl 401c5820 20000000 returned -22 [ 1786.771767][T26978] binder: 26977:26978 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000480)={0x8, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/76, 0x4c}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/13, 0xd}, {&(0x7f00000001c0)=""/14, 0xe}, {&(0x7f0000000200)=""/125, 0x7d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000000280)=""/17, 0x11}, {&(0x7f00000002c0)=""/229, 0xe5}], &(0x7f0000000440)=[0xb918, 0x40, 0x0, 0x80000000, 0x100000001, 0x2]}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: memfd_create(&(0x7f0000000040)='{:)!+\x00', 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) io_cancel(0x0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, r1, &(0x7f0000000540)}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB="00000080ff0031f10000000645030014006400201f2973efe8507c9401f28b08"]}) memfd_create(&(0x7f0000000040)='{:)!+\x00', 0x4) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) io_cancel(0x0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, r1, &(0x7f0000000540)}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB="00000080ff0031f10000000645030014006400201f2973efe8507c9401f28b08"]}) (async) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: memfd_create(&(0x7f0000000040)='{:)!+\x00', 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) io_cancel(0x0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, r1, &(0x7f0000000540)}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB="00000080ff0031f10000000645030014006400201f2973efe8507c9401f28b08"]}) memfd_create(&(0x7f0000000040)='{:)!+\x00', 0x4) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) io_cancel(0x0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x1, r1, &(0x7f0000000540)}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB="00000080ff0031f10000000645030014006400201f2973efe8507c9401f28b08"]}) (async) [ 1786.792709][T26983] binder: 26981:26983 ioctl 401c5820 200004c0 returned -22 [ 1786.807780][T26984] binder: 26979:26984 ioctl 40086602 20000000 returned -22 [ 1786.809382][T26987] binder: 26980:26987 ioctl 40086602 20000000 returned -22 [ 1786.829676][T26988] binder: 26986:26988 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x500, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000480)={0x8, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/76, 0x4c}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/13, 0xd}, {&(0x7f00000001c0)=""/14, 0xe}, {&(0x7f0000000200)=""/125, 0x7d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000000280)=""/17, 0x11}, {&(0x7f00000002c0)=""/229, 0xe5}], &(0x7f0000000440)=[0xb918, 0x40, 0x0, 0x80000000, 0x100000001, 0x2]}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x2500000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000480)={0x8, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/76, 0x4c}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/13, 0xd}, {&(0x7f00000001c0)=""/14, 0xe}, {&(0x7f0000000200)=""/125, 0x7d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000000280)=""/17, 0x11}, {&(0x7f00000002c0)=""/229, 0xe5}], &(0x7f0000000440)=[0xb918, 0x40, 0x0, 0x80000000, 0x100000001, 0x2]}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs2/custom0\x00', 0x0, 0x0) (async) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) (async) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000480)={0x8, 0x1, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/76, 0x4c}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/13, 0xd}, {&(0x7f00000001c0)=""/14, 0xe}, {&(0x7f0000000200)=""/125, 0x7d}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000000280)=""/17, 0x11}, {&(0x7f00000002c0)=""/229, 0xe5}], &(0x7f0000000440)=[0xb918, 0x40, 0x0, 0x80000000, 0x100000001, 0x2]}, 0x20) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) [ 1786.842226][T26999] binder: 26998:26999 ioctl 401c5820 20000000 returned -22 [ 1786.856719][T27007] binder: 27006:27007 ioctl 40086602 20000000 returned -22 [ 1786.877921][T27009] binder: 27008:27009 ioctl 401c5820 20000000 returned -22 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x8000000) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x58, r2, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4089}, 0x40) 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x600, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1786.891906][T27015] binder: 27011:27015 ioctl 40086602 20000000 returned -22 [ 1786.901092][T27019] binder: 27013:27019 ioctl 401c5820 20000000 returned -22 [ 1786.921361][T27024] binder: 27022:27024 ioctl 401c5820 200004c0 returned -22 [ 1786.928271][T27029] binder: 27028:27029 ioctl 401c5820 20000000 returned -22 [ 1786.933666][T27027] binder: 27026:27027 ioctl 40086602 20000000 returned -22 10:17:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x8000000) (async, rerun: 64) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x58, r2, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4089}, 0x40) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x700, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 5: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x2, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x900, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x4c00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1786.942665][T27025] binder: 27023:27025 ioctl 40086602 20000000 returned -22 [ 1786.954843][T27032] binder: 27031:27032 ioctl 401c5820 200004c0 returned -22 [ 1786.964307][T27034] binder: 27033:27034 ioctl 401c5820 20000000 returned -22 [ 1786.965886][T27036] binder: 27030:27036 ioctl 401c5820 20000000 returned -22 [ 1786.984912][T27041] binder: 27040:27041 ioctl 40086602 20000000 returned -22 10:17:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:38 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r1, 0x8000000) (async) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x58, r2, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4089}, 0x40) [ 1787.009111][T27046] binder: 27043:27046 ioctl 401c5820 200004c0 returned -22 [ 1787.013311][T27049] binder: 27048:27049 ioctl 401c5820 20000000 returned -22 [ 1787.018184][T27050] binder: 27047:27050 ioctl 401c5820 20000000 returned -22 [ 1787.024605][T27051] binder: 27045:27051 ioctl 40086602 20000000 returned -22 [ 1787.033218][T27052] binder: 27042:27052 ioctl 40086602 20000000 returned -22 10:17:38 executing program 5: r0 = io_uring_setup(0x3055, &(0x7f0000000080)={0x0, 0xcbf7, 0x2, 0x0, 0x335}) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_setup(0x90b, &(0x7f0000000440)={0x0, 0x60cb, 0x400, 0x1, 0x15e, 0x0, r0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000008, 0x810, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r2 = io_uring_setup(0x712a, &(0x7f0000000140)={0x0, 0x7186, 0x48, 0x2, 0x2f5, 0x0, r0}) r3 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0xa40) io_setup(0x40, &(0x7f0000000140)=0x0) bpf$PROG_LOAD_XDP(0x8, 0x0, 0x0) io_submit(r4, 0x1, &(0x7f0000000300)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xffff, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) ioctl$RTC_UIE_OFF(r3, 0x7004) io_uring_setup(0x6175, &(0x7f00000001c0)={0x0, 0xfde, 0x2, 0x3, 0x1c4, 0x0, r0}) r5 = io_uring_setup(0x2a30, &(0x7f0000000240)={0x0, 0x92c9, 0x1012, 0x3, 0x393, 0x0, r2}) ioctl$RTC_RD_TIME(r3, 0x80247009, &(0x7f00000002c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r5, 0xe, &(0x7f0000000400)={0x8, 0x0, &(0x7f0000000380), &(0x7f00000003c0)=[0x4]}, 0x20) clock_getres(0x5, &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xa00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: syz_emit_ethernet(0xaf, &(0x7f0000000480)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@llc_tr={0x11, {@snap={0xaa, 0x155, "d4ee", "66ca02", 0x17, "657717cde37da75f251b524add5d416098dc594b231d2aace652bc83b7b622fd7d5f80901069be61218708145068ea9473d8063d10de1dac5cbe42d791e1ea02c9576b052dc142d0658cfc9adbe132102de0d2d0eb8d54e4c0f736db138d925ea474b98698581d91dd146cb33556f12b9aa6c02cb8c78dfc6415cd179b97b0966891f1a40e87b2fa5d776e4f4ad927e26224655ebd04a722"}}}}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) r2 = syz_mount_image$fuse(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, &(0x7f0000000800)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@default_permissions}, {}, {@blksize}]}}, 0x0, 0x0, 0x0) readlinkat(r1, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)=""/128, 0x80) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r1}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r2, @ANYRES32, @ANYRES32=r2]}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', r4}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x4, 0x0, r1, 0x0, '\x00', r4, r1}, 0x48) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'erspan0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='gretap0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5, @ANYBLOB="00408000ffffffff0000000645b500940064000081049078ffffffffac1e0101861126ed363a95e974a103fb563fa41dbf832bebffffffff6401010264010100000000007f0000010a0101007f00000100000000ffffffff640101010717a900000000ac1e0001ac14141e0a010101ac14142f94100414ffcdfaa57e66cce7f422f835010100890b0e000000000a010102440ca09000008001fffffffe000000"]}) renameat(r2, &(0x7f0000000100)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00') 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1787.054240][T27054] binder: 27053:27054 ioctl 401c5820 20000000 returned -22 [ 1787.077825][T27060] binder: 27059:27060 ioctl 40086602 20000000 returned -22 [ 1787.089020][T27068] binder: 27066:27068 ioctl 40086602 20000000 returned -22 [ 1787.091829][T27063] binder: 27061:27063 ioctl 401c5820 200004c0 returned -22 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xb00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x6c00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = io_uring_setup(0x3055, &(0x7f0000000080)={0x0, 0xcbf7, 0x2, 0x0, 0x335}) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_setup(0x90b, &(0x7f0000000440)={0x0, 0x60cb, 0x400, 0x1, 0x15e, 0x0, r0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000008, 0x810, r0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) r2 = io_uring_setup(0x712a, &(0x7f0000000140)={0x0, 0x7186, 0x48, 0x2, 0x2f5, 0x0, r0}) r3 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0xa40) io_setup(0x40, &(0x7f0000000140)=0x0) bpf$PROG_LOAD_XDP(0x8, 0x0, 0x0) (async) io_submit(r4, 0x1, &(0x7f0000000300)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xffff, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) (async) ioctl$RTC_UIE_OFF(r3, 0x7004) (async) io_uring_setup(0x6175, &(0x7f00000001c0)={0x0, 0xfde, 0x2, 0x3, 0x1c4, 0x0, r0}) (async) r5 = io_uring_setup(0x2a30, &(0x7f0000000240)={0x0, 0x92c9, 0x1012, 0x3, 0x393, 0x0, r2}) (async) ioctl$RTC_RD_TIME(r3, 0x80247009, &(0x7f00000002c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r5, 0xe, &(0x7f0000000400)={0x8, 0x0, &(0x7f0000000380), &(0x7f00000003c0)=[0x4]}, 0x20) clock_getres(0x5, &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: syz_emit_ethernet(0xaf, &(0x7f0000000480)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@llc_tr={0x11, {@snap={0xaa, 0x155, "d4ee", "66ca02", 0x17, "657717cde37da75f251b524add5d416098dc594b231d2aace652bc83b7b622fd7d5f80901069be61218708145068ea9473d8063d10de1dac5cbe42d791e1ea02c9576b052dc142d0658cfc9adbe132102de0d2d0eb8d54e4c0f736db138d925ea474b98698581d91dd146cb33556f12b9aa6c02cb8c78dfc6415cd179b97b0966891f1a40e87b2fa5d776e4f4ad927e26224655ebd04a722"}}}}}, 0x0) (async, rerun: 32) r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) r2 = syz_mount_image$fuse(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, &(0x7f0000000800)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@default_permissions}, {}, {@blksize}]}}, 0x0, 0x0, 0x0) readlinkat(r1, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)=""/128, 0x80) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r1}, 0x4) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r2, @ANYRES32, @ANYRES32=r2]}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', r4}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x4, 0x0, r1, 0x0, '\x00', r4, r1}, 0x48) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'erspan0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='gretap0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5, @ANYBLOB="00408000ffffffff0000000645b500940064000081049078ffffffffac1e0101861126ed363a95e974a103fb563fa41dbf832bebffffffff6401010264010100000000007f0000010a0101007f00000100000000ffffffff640101010717a900000000ac1e0001ac14141e0a010101ac14142f94100414ffcdfaa57e66cce7f422f835010100890b0e000000000a010102440ca09000008001fffffffe000000"]}) renameat(r2, &(0x7f0000000100)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00') 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1787.098170][T27071] binder: 27062:27071 ioctl 401c5820 20000000 returned -22 [ 1787.117169][T27067] fuse: blksize only supported for fuseblk [ 1787.119900][T27073] binder: 27072:27073 ioctl 40086602 20000000 returned -22 [ 1787.130438][T27075] binder: 27074:27075 ioctl 401c5820 20000000 returned -22 [ 1787.148898][T27086] binder: 27084:27086 ioctl 40086602 20000000 returned -22 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = io_uring_setup(0x3055, &(0x7f0000000080)={0x0, 0xcbf7, 0x2, 0x0, 0x335}) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) (async) io_uring_setup(0x90b, &(0x7f0000000440)={0x0, 0x60cb, 0x400, 0x1, 0x15e, 0x0, r0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000008, 0x810, r0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r2 = io_uring_setup(0x712a, &(0x7f0000000140)={0x0, 0x7186, 0x48, 0x2, 0x2f5, 0x0, r0}) (async) r3 = syz_open_dev$mouse(&(0x7f00000004c0), 0x0, 0xa40) io_setup(0x40, &(0x7f0000000140)=0x0) (async, rerun: 32) bpf$PROG_LOAD_XDP(0x8, 0x0, 0x0) (rerun: 32) io_submit(r4, 0x1, &(0x7f0000000300)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xffff, r3, 0x0, 0x0, 0x0, 0x0, 0x2}]) (async) ioctl$RTC_UIE_OFF(r3, 0x7004) io_uring_setup(0x6175, &(0x7f00000001c0)={0x0, 0xfde, 0x2, 0x3, 0x1c4, 0x0, r0}) (async) r5 = io_uring_setup(0x2a30, &(0x7f0000000240)={0x0, 0x92c9, 0x1012, 0x3, 0x393, 0x0, r2}) (async) ioctl$RTC_RD_TIME(r3, 0x80247009, &(0x7f00000002c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) (async) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r5, 0xe, &(0x7f0000000400)={0x8, 0x0, &(0x7f0000000380), &(0x7f00000003c0)=[0x4]}, 0x20) (async, rerun: 32) clock_getres(0x5, &(0x7f0000000340)) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000000)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7400000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xc00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x14, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffe1}, {}, {}, [@generic={0x0, 0x0, 0x1, 0x7ff, 0x9c}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x3}, @map_val={0x18, 0x8, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200}]}, &(0x7f00000000c0)='GPL\x00', 0x4831, 0x7f, &(0x7f0000000280)=""/127, 0x41000, 0x50, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x5, 0x7, 0xdf1, 0xf8bf}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000340)=[0xffffffffffffffff], &(0x7f0000000380)=[{0x1, 0x1, 0x4, 0x6}, {0x4, 0x4, 0x5, 0xa}, {0x4, 0x1, 0x5, 0x6}, {0x3, 0x1, 0x9, 0x4}, {0x3, 0x5, 0x7, 0x3}, {0x1, 0x2, 0x0, 0x4}], 0x10, 0xd6}, 0x90) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000009, 0x10, r0, 0x8000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f0000000080), &(0x7f0000000500)=r1}, 0x20) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1787.153429][T27089] fuse: blksize only supported for fuseblk [ 1787.172850][T27093] binder: 27090:27093 ioctl 401c5820 20000000 returned -22 [ 1787.185127][T27099] binder: 27098:27099 ioctl 40086602 20000000 returned -22 [ 1787.193523][T27102] binder: 27095:27102 ioctl 401c5820 20000000 returned -22 [ 1787.200942][T27104] binder: 27103:27104 ioctl 401c5820 20000000 returned -22 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: syz_emit_ethernet(0xaf, &(0x7f0000000480)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@llc_tr={0x11, {@snap={0xaa, 0x155, "d4ee", "66ca02", 0x17, "657717cde37da75f251b524add5d416098dc594b231d2aace652bc83b7b622fd7d5f80901069be61218708145068ea9473d8063d10de1dac5cbe42d791e1ea02c9576b052dc142d0658cfc9adbe132102de0d2d0eb8d54e4c0f736db138d925ea474b98698581d91dd146cb33556f12b9aa6c02cb8c78dfc6415cd179b97b0966891f1a40e87b2fa5d776e4f4ad927e26224655ebd04a722"}}}}}, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) r2 = syz_mount_image$fuse(&(0x7f00000006c0), &(0x7f0000000700)='./file0\x00', 0x0, &(0x7f0000000800)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@default_permissions}, {}, {@blksize}]}}, 0x0, 0x0, 0x0) (async) readlinkat(r1, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)=""/128, 0x80) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r1}, 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYRES16=r2, @ANYRES32, @ANYRES32=r2]}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', r4}, 0x48) (async, rerun: 32) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x4, 0x0, r1, 0x0, '\x00', r4, r1}, 0x48) (rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'erspan0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='gretap0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5, @ANYBLOB="00408000ffffffff0000000645b500940064000081049078ffffffffac1e0101861126ed363a95e974a103fb563fa41dbf832bebffffffff6401010264010100000000007f0000010a0101007f00000100000000ffffffff640101010717a900000000ac1e0001ac14141e0a010101ac14142f94100414ffcdfaa57e66cce7f422f835010100890b0e000000000a010102440ca09000008001fffffffe000000"]}) (async, rerun: 32) renameat(r2, &(0x7f0000000100)='./file0/file0\x00', r1, &(0x7f0000000140)='./file0\x00') (rerun: 32) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x7a00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = gettid() sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x7) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)=ANY=[]}) r2 = getpgid(0x0) capset(&(0x7f0000000000)={0x19980330, r2}, 0x0) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x6, 0x19, 0xff, 0x2, 0xe56, 0xffffffffffffffd1, 0x2, 0x2, 0x6}, 0x0) r3 = syz_open_dev$rtc(&(0x7f0000000000), 0x8000000000000001, 0x10000) ioctl$RTC_EPOCH_READ(r3, 0x8008700d, &(0x7f00000000c0)) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x0, r3}, 0x18) [ 1787.208281][T27101] binder: 27100:27101 ioctl 40086602 20000000 returned -22 [ 1787.225832][T27110] fuse: blksize only supported for fuseblk [ 1787.226841][T27113] binder: 27109:27113 ioctl 401c5820 20000000 returned -22 [ 1787.248717][T27115] binder: 27114:27115 ioctl 401c5820 200004c0 returned -22 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x14, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffe1}, {}, {}, [@generic={0x0, 0x0, 0x1, 0x7ff, 0x9c}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x3}, @map_val={0x18, 0x8, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200}]}, &(0x7f00000000c0)='GPL\x00', 0x4831, 0x7f, &(0x7f0000000280)=""/127, 0x41000, 0x50, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x5, 0x7, 0xdf1, 0xf8bf}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000340)=[0xffffffffffffffff], &(0x7f0000000380)=[{0x1, 0x1, 0x4, 0x6}, {0x4, 0x4, 0x5, 0xa}, {0x4, 0x1, 0x5, 0x6}, {0x3, 0x1, 0x9, 0x4}, {0x3, 0x5, 0x7, 0x3}, {0x1, 0x2, 0x0, 0x4}], 0x10, 0xd6}, 0x90) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000009, 0x10, r0, 0x8000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f0000000080), &(0x7f0000000500)=r1}, 0x20) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xd00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xffffffff00000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = gettid() sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x7) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)=ANY=[]}) r2 = getpgid(0x0) capset(&(0x7f0000000000)={0x19980330, r2}, 0x0) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x6, 0x19, 0xff, 0x2, 0xe56, 0xffffffffffffffd1, 0x2, 0x2, 0x6}, 0x0) r3 = syz_open_dev$rtc(&(0x7f0000000000), 0x8000000000000001, 0x10000) ioctl$RTC_EPOCH_READ(r3, 0x8008700d, &(0x7f00000000c0)) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x0, r3}, 0x18) socket$inet_udp(0x2, 0x2, 0x0) (async) gettid() (async) sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x7) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)=ANY=[]}) (async) getpgid(0x0) (async) capset(&(0x7f0000000000)={0x19980330, r2}, 0x0) (async) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x6, 0x19, 0xff, 0x2, 0xe56, 0xffffffffffffffd1, 0x2, 0x2, 0x6}, 0x0) (async) syz_open_dev$rtc(&(0x7f0000000000), 0x8000000000000001, 0x10000) (async) ioctl$RTC_EPOCH_READ(r3, 0x8008700d, &(0x7f00000000c0)) (async) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x0, r3}, 0x18) (async) [ 1787.250642][T27119] binder: 27116:27119 ioctl 40086602 20000000 returned -22 [ 1787.262917][T27118] binder: 27117:27118 ioctl 401c5820 20000000 returned -22 [ 1787.276921][T27124] binder: 27123:27124 ioctl 401c5820 200004c0 returned -22 [ 1787.285657][T27129] binder: 27128:27129 ioctl 40086602 20000000 returned -22 [ 1787.285788][T27122] binder: 27121:27122 ioctl 401c5820 20000000 returned -22 [ 1787.299085][T27131] binder: 27130:27131 ioctl 40086602 20000000 returned -22 10:17:39 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = gettid() sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x7) (async) sched_setscheduler(r1, 0x1, &(0x7f0000000080)=0x7) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)=ANY=[]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)=ANY=[]}) r2 = getpgid(0x0) capset(&(0x7f0000000000)={0x19980330, r2}, 0x0) sched_setattr(r2, &(0x7f0000000040)={0x38, 0x6, 0x19, 0xff, 0x2, 0xe56, 0xffffffffffffffd1, 0x2, 0x2, 0x6}, 0x0) r3 = syz_open_dev$rtc(&(0x7f0000000000), 0x8000000000000001, 0x10000) ioctl$RTC_EPOCH_READ(r3, 0x8008700d, &(0x7f00000000c0)) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@o_path={&(0x7f0000000140)='./file0\x00', 0x0, 0x0, r3}, 0x18) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xffffffffff600000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xe00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x14, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffe1}, {}, {}, [@generic={0x0, 0x0, 0x1, 0x7ff, 0x9c}, @cb_func={0x18, 0x3, 0x4, 0x0, 0x3}, @map_val={0x18, 0x8, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x200}]}, &(0x7f00000000c0)='GPL\x00', 0x4831, 0x7f, &(0x7f0000000280)=""/127, 0x41000, 0x50, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x5, 0x7, 0xdf1, 0xf8bf}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000340)=[0xffffffffffffffff], &(0x7f0000000380)=[{0x1, 0x1, 0x4, 0x6}, {0x4, 0x4, 0x5, 0xa}, {0x4, 0x1, 0x5, 0x6}, {0x3, 0x1, 0x9, 0x4}, {0x3, 0x5, 0x7, 0x3}, {0x1, 0x2, 0x0, 0x4}], 0x10, 0xd6}, 0x90) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000009, 0x10, r0, 0x8000000) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r0}, &(0x7f0000000080), &(0x7f0000000500)=r1}, 0x20) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) socket$can_raw(0x1d, 0x3, 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@ifindex=r1, 0x7, 0x1, 0x6, &(0x7f00000000c0)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0]}, 0x40) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) socket$can_raw(0x1d, 0x3, 0x1) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@ifindex=r1, 0x7, 0x1, 0x6, &(0x7f00000000c0)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0]}, 0x40) [ 1787.310987][T27134] binder: 27132:27134 ioctl 401c5820 20000000 returned -22 [ 1787.332665][T27146] binder: 27145:27146 ioctl 401c5820 20000000 returned -22 [ 1787.341954][T27152] binder: 27148:27152 ioctl 401c5820 200004c0 returned -22 [ 1787.351781][T27150] binder: 27147:27150 ioctl 40086602 20000000 returned -22 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1100, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) socket$can_raw(0x1d, 0x3, 0x1) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@ifindex=r1, 0x7, 0x1, 0x6, &(0x7f00000000c0)=[0x0, 0x0], 0x2, 0x0, &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0]}, 0x40) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1200, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = io_uring_setup(0x1105, &(0x7f0000000000)={0x0, 0x4d45, 0x4, 0x3, 0x39e}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000080)=[@ioring_restriction_sqe_flags_required={0x3, 0x12}, @ioring_restriction_sqe_op={0x1, 0x17}, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_op={0x1, 0x3}, @ioring_restriction_sqe_flags_allowed], 0x6) [ 1787.358916][T27158] binder: 27157:27158 ioctl 40086602 20000000 returned -22 [ 1787.367601][T27163] binder: 27156:27163 ioctl 401c5820 20000000 returned -22 [ 1787.385861][T27166] binder: 27165:27166 ioctl 40086602 20000000 returned -22 [ 1787.400991][T27169] binder: 27168:27169 ioctl 401c5820 20000000 returned -22 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000000), 0x6de, 0x50180) write$P9_RLCREATE(r1, 0x0, 0x0) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000003bbbbbbbbbbbbaaaaaaaaaaaa000401aaf96e0db46b121aed2718da43d97a532b0cb48ae798131f7a8bbdd175be50839d93ded7eaccb9406c0919d609095442fdc463e3f2ebfac8bface63d14b56ceb4b7ba06d54b3e5b21d0567f9808c1065e66db0abdffd0cf8472f90b548e5fc41efd384b5e4e72e1ad51784f316a6d879a929c5f2627972576c63cc4c91c0ef49dbe3540fc0e2038a116ad2ec7ea09c5fe0f0ed8fa279c0eab44d30d00c29ea5ab568374291ce7dddf4820f71804ac7fd0000da9a735d0d5265b909daaa8454"], 0xd1) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = io_uring_setup(0x1105, &(0x7f0000000000)={0x0, 0x4d45, 0x4, 0x3, 0x39e}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000080)=[@ioring_restriction_sqe_flags_required={0x3, 0x12}, @ioring_restriction_sqe_op={0x1, 0x17}, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_op={0x1, 0x3}, @ioring_restriction_sqe_flags_allowed], 0x6) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) io_uring_setup(0x1105, &(0x7f0000000000)={0x0, 0x4d45, 0x4, 0x3, 0x39e}) (async) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000080)=[@ioring_restriction_sqe_flags_required={0x3, 0x12}, @ioring_restriction_sqe_op={0x1, 0x17}, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_op={0x1, 0x3}, @ioring_restriction_sqe_flags_allowed], 0x6) (async) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1787.408670][T27172] binder: 27171:27172 ioctl 40086602 20000000 returned -22 [ 1787.411220][T27176] binder: 27167:27176 ioctl 401c5820 200004c0 returned -22 [ 1787.424990][T27177] binder: 27175:27177 ioctl 401c5820 20000000 returned -22 [ 1787.426661][T27179] binder: 27178:27179 ioctl 40086602 20000000 returned -22 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000000), 0x6de, 0x50180) write$P9_RLCREATE(r1, 0x0, 0x0) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000003bbbbbbbbbbbbaaaaaaaaaaaa000401aaf96e0db46b121aed2718da43d97a532b0cb48ae798131f7a8bbdd175be50839d93ded7eaccb9406c0919d609095442fdc463e3f2ebfac8bface63d14b56ceb4b7ba06d54b3e5b21d0567f9808c1065e66db0abdffd0cf8472f90b548e5fc41efd384b5e4e72e1ad51784f316a6d879a929c5f2627972576c63cc4c91c0ef49dbe3540fc0e2038a116ad2ec7ea09c5fe0f0ed8fa279c0eab44d30d00c29ea5ab568374291ce7dddf4820f71804ac7fd0000da9a735d0d5265b909daaa8454"], 0xd1) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000000), 0x6de, 0x50180) write$P9_RLCREATE(r1, 0x0, 0x0) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000003bbbbbbbbbbbbaaaaaaaaaaaa000401aaf96e0db46b121aed2718da43d97a532b0cb48ae798131f7a8bbdd175be50839d93ded7eaccb9406c0919d609095442fdc463e3f2ebfac8bface63d14b56ceb4b7ba06d54b3e5b21d0567f9808c1065e66db0abdffd0cf8472f90b548e5fc41efd384b5e4e72e1ad51784f316a6d879a929c5f2627972576c63cc4c91c0ef49dbe3540fc0e2038a116ad2ec7ea09c5fe0f0ed8fa279c0eab44d30d00c29ea5ab568374291ce7dddf4820f71804ac7fd0000da9a735d0d5265b909daaa8454"], 0xd1) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) syz_open_dev$mouse(&(0x7f0000000000), 0x6de, 0x50180) (async) write$P9_RLCREATE(r1, 0x0, 0x0) (async) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000003bbbbbbbbbbbbaaaaaaaaaaaa000401aaf96e0db46b121aed2718da43d97a532b0cb48ae798131f7a8bbdd175be50839d93ded7eaccb9406c0919d609095442fdc463e3f2ebfac8bface63d14b56ceb4b7ba06d54b3e5b21d0567f9808c1065e66db0abdffd0cf8472f90b548e5fc41efd384b5e4e72e1ad51784f316a6d879a929c5f2627972576c63cc4c91c0ef49dbe3540fc0e2038a116ad2ec7ea09c5fe0f0ed8fa279c0eab44d30d00c29ea5ab568374291ce7dddf4820f71804ac7fd0000da9a735d0d5265b909daaa8454"], 0xd1) (async) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1800, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0xf8, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x100b, 0x3}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x400}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f00000002c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x1}, @fda={0x66646185, 0x1, 0x0, 0xd}, @flat=@binder={0x73622a85, 0x10e}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x1}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/3, 0x3, 0x2, 0xc}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0xb, 0x3}}, &(0x7f0000000440)={0x0, 0x28, 0x40}}}], 0xce, 0x0, &(0x7f0000000580)="864fe737d291cb433155428fabb01ba034fdcf2ec41b65a11cc51b656cf7bd9f213b1104c15b5128fd205c38ed747222846e63b16b697644f9edae42c9ca13033168df653dee6498d37e254c0e188621c185bd5c8646d6d5667019358eefea8a60c2004c31a3df7214083ffd36ba1971c0293869b6a7826c235aa32c88669ee581680838459f8bafcb05f1245f5abe0dc7df32fa41b56752022ce2a37831b95670c8cf228dea5255dbeee02cdd7c02d471a4b9e0cbf61a2416b58be753f3444e74559d416ac147d172244424e2c6"}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x9}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x733}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x20}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1787.458579][T27187] binder: 27181:27187 ioctl 40086602 20000000 returned -22 [ 1787.458726][T27188] binder: 27186:27188 ioctl 401c5820 20000000 returned -22 [ 1787.473124][T27185] binder: 27182:27185 ioctl 401c5820 200004c0 returned -22 [ 1787.474165][T27191] binder: 27184:27191 ioctl 401c5820 20000000 returned -22 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = io_uring_setup(0x1105, &(0x7f0000000000)={0x0, 0x4d45, 0x4, 0x3, 0x39e}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000080)=[@ioring_restriction_sqe_flags_required={0x3, 0x12}, @ioring_restriction_sqe_op={0x1, 0x17}, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_flags_required, @ioring_restriction_sqe_op={0x1, 0x3}, @ioring_restriction_sqe_flags_allowed], 0x6) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x2500, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0xf8, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x100b, 0x3}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x400}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f00000002c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x1}, @fda={0x66646185, 0x1, 0x0, 0xd}, @flat=@binder={0x73622a85, 0x10e}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x1}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/3, 0x3, 0x2, 0xc}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0xb, 0x3}}, &(0x7f0000000440)={0x0, 0x28, 0x40}}}], 0xce, 0x0, &(0x7f0000000580)="864fe737d291cb433155428fabb01ba034fdcf2ec41b65a11cc51b656cf7bd9f213b1104c15b5128fd205c38ed747222846e63b16b697644f9edae42c9ca13033168df653dee6498d37e254c0e188621c185bd5c8646d6d5667019358eefea8a60c2004c31a3df7214083ffd36ba1971c0293869b6a7826c235aa32c88669ee581680838459f8bafcb05f1245f5abe0dc7df32fa41b56752022ce2a37831b95670c8cf228dea5255dbeee02cdd7c02d471a4b9e0cbf61a2416b58be753f3444e74559d416ac147d172244424e2c6"}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x9}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x733}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x20}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder0\x00', 0x800, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0xf8, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x100b, 0x3}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x400}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f00000002c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x1}, @fda={0x66646185, 0x1, 0x0, 0xd}, @flat=@binder={0x73622a85, 0x10e}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x1}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/3, 0x3, 0x2, 0xc}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0xb, 0x3}}, &(0x7f0000000440)={0x0, 0x28, 0x40}}}], 0xce, 0x0, &(0x7f0000000580)="864fe737d291cb433155428fabb01ba034fdcf2ec41b65a11cc51b656cf7bd9f213b1104c15b5128fd205c38ed747222846e63b16b697644f9edae42c9ca13033168df653dee6498d37e254c0e188621c185bd5c8646d6d5667019358eefea8a60c2004c31a3df7214083ffd36ba1971c0293869b6a7826c235aa32c88669ee581680838459f8bafcb05f1245f5abe0dc7df32fa41b56752022ce2a37831b95670c8cf228dea5255dbeee02cdd7c02d471a4b9e0cbf61a2416b58be753f3444e74559d416ac147d172244424e2c6"}) (async) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x9}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x733}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x20}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) (async) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1787.508629][T27202] binder: 27182:27202 ioctl 401c5820 200004c0 returned -22 [ 1787.510509][T27201] binder: 27199:27201 ioctl 40086602 20000000 returned -22 [ 1787.523359][T27207] binder: 27198:27207 ioctl 40086602 20000000 returned -22 [ 1787.524331][T27208] binder: 27200:27208 ioctl 401c5820 20000000 returned -22 [ 1787.541115][T27210] binder: 27209:27210 ioctl 401c5820 20000000 returned -22 [ 1787.544234][T27212] binder: 27211:27212 ioctl 401c5820 200004c0 returned -22 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) read$char_usb(r1, 0x0, 0x0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000000)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+10000}}, 0x100) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0xf8, 0x0, &(0x7f0000000480)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000200)={@flat=@weak_binder={0x77622a85, 0x0, 0x1}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0x100b, 0x3}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x400}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f00000002c0)={@flat=@weak_binder={0x77622a85, 0xa, 0x1}, @fda={0x66646185, 0x1, 0x0, 0xd}, @flat=@binder={0x73622a85, 0x10e}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}}, @request_death={0x400c630e, 0x1}, @increfs_done={0x40106308, 0x2}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/3, 0x3, 0x2, 0xc}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0xb, 0x3}}, &(0x7f0000000440)={0x0, 0x28, 0x40}}}], 0xce, 0x0, &(0x7f0000000580)="864fe737d291cb433155428fabb01ba034fdcf2ec41b65a11cc51b656cf7bd9f213b1104c15b5128fd205c38ed747222846e63b16b697644f9edae42c9ca13033168df653dee6498d37e254c0e188621c185bd5c8646d6d5667019358eefea8a60c2004c31a3df7214083ffd36ba1971c0293869b6a7826c235aa32c88669ee581680838459f8bafcb05f1245f5abe0dc7df32fa41b56752022ce2a37831b95670c8cf228dea5255dbeee02cdd7c02d471a4b9e0cbf61a2416b58be753f3444e74559d416ac147d172244424e2c6"}) (async) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x9}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x733}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x20}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4800, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1787.561311][T27214] binder: 27213:27214 ioctl 40086602 20000000 returned -22 [ 1787.568400][T27218] binder: 27217:27218 ioctl 401c5820 20000000 returned -22 [ 1787.580582][T27216] binder: 27215:27216 ioctl 40086602 20000000 returned -22 [ 1787.594304][T27226] binder: 27225:27226 ioctl 401c5820 200004c0 returned -22 [ 1787.600213][T27229] binder: 27228:27229 ioctl 401c5820 20000000 returned -22 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402b00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) read$char_usb(r1, 0x0, 0x0) (async) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000000)) (async) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+10000}}, 0x100) (async) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = gettid() ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r0, @ANYRES64=r1]}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402d00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1787.612257][T27230] binder: 27227:27230 ioctl 401c5820 20000000 returned -22 [ 1787.632692][T27242] binder: 27233:27242 ioctl 40086602 20000000 returned -22 [ 1787.633172][T27241] binder: 27240:27241 ioctl 40086602 20000000 returned -22 [ 1787.649603][T27238] binder: 27236:27238 ioctl 401c5820 200004c0 returned -22 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) r1 = gettid() (rerun: 32) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r0, @ANYRES64=r1]}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4c00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40402e00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = gettid() ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=r0, @ANYRES64=r1]}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) read$char_usb(r1, 0x0, 0x0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000000)) (async) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={{r2, r3/1000+10000}}, 0x100) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1787.650583][T27239] binder: 27234:27239 ioctl 401c5820 20000000 returned -22 [ 1787.670693][T27248] binder: 27247:27248 ioctl 401c5820 20000000 returned -22 [ 1787.672302][T27250] binder: 27249:27250 ioctl 40086602 20000000 returned -22 [ 1787.694874][T27262] binder: 27256:27262 ioctl 401c5820 20000000 returned -22 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x60ff, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40403000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)='%pI4 \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000280), &(0x7f00000002c0)='%pS \x00'}, 0x20) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x401c5820, &(0x7f00000004c0)={0x54, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000040)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/47, 0x2f, 0x1, 0x39}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}, @increfs={0x40046304, 0x1}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) [ 1787.710595][T27264] binder: 27261:27264 ioctl 40086602 20000000 returned -22 [ 1787.710595][T27265] binder: 27263:27265 ioctl 40086602 20000000 returned -22 [ 1787.720820][T27271] binder: 27270:27271 ioctl 401c5820 20000000 returned -22 [ 1787.734283][T27269] binder: 27266:27269 ioctl 401c5820 200004c0 returned -22 [ 1787.746998][T27279] binder: 27277:27279 ioctl 401c5820 20000000 returned -22 [ 1787.755548][T27280] binder: 27276:27280 ioctl 40086602 20000000 returned -22 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40404c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0x1}, &(0x7f00000001c0), &(0x7f0000000200)='%pI4 \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)='%pI4 \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000280), &(0x7f00000002c0)='%pS \x00'}, 0x20) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x401c5820, &(0x7f00000004c0)={0x54, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000040)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/47, 0x2f, 0x1, 0x39}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}, @increfs={0x40046304, 0x1}], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6800, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40405800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0x1, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)='%pI4 \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{r0}, &(0x7f0000000280), &(0x7f00000002c0)='%pS \x00'}, 0x20) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x401c5820, &(0x7f00000004c0)={0x54, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000040)={@flat=@handle={0x73682a85, 0x1, 0x3}, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/47, 0x2f, 0x1, 0x39}}, &(0x7f00000000c0)={0x0, 0x18, 0x30}}}, @increfs={0x40046304, 0x1}], 0x0, 0x0, 0x0}) [ 1787.769487][T27284] binder: 27282:27284 ioctl 40086602 20000000 returned -22 [ 1787.789120][T27292] binder: 27286:27292 ioctl 401c5820 20000000 returned -22 [ 1787.799313][T27291] binder: 27287:27291 ioctl 401c5820 20000000 returned -22 [ 1787.801701][T27298] binder: 27296:27298 ioctl 40086602 20000000 returned -22 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1787.831185][T27303] binder: 27301:27303 ioctl 401c5820 20000000 returned -22 [ 1787.846480][T27310] binder: 27309:27310 ioctl 40086602 20000000 returned -22 [ 1787.851745][T27314] binder: 27313:27314 ioctl 401c5820 20000000 returned -22 [ 1787.853538][T27305] binder: 27304:27305 ioctl 401c5820 20000000 returned -22 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6c00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x1100000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="889b0e9b7ccd7a1f9e36a400000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xa00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1787.876709][T27312] binder: 27311:27312 ioctl 40086602 20000000 returned -22 [ 1787.878397][T27318] binder: 27316:27318 ioctl 401c5820 20000000 returned -22 [ 1787.893629][T27323] binder: 27322:27323 ioctl 40086602 20000000 returned -22 [ 1787.894179][T27320] binder: 27319:27320 ioctl 40086602 20000000 returned -22 [ 1787.921285][T27328] binder: 27327:27328 ioctl 40086602 20000000 returned -22 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7400, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="889b0e9b7ccd7a1f9e36a400000080ff0031f10000000645030014006400201f29"]}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="889b0e9b7ccd7a1f9e36a400000080ff0031f10000000645030014006400201f29"]}) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYBLOB="889b0e9b7ccd7a1f9e36a400000080ff0031f10000000645030014006400201f29"]}) (async) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7a00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1787.925228][T27330] binder: 27329:27330 ioctl 401c5820 20000000 returned -22 [ 1787.944172][T27332] binder: 27331:27332 ioctl 401c5820 20000000 returned -22 [ 1787.952566][T27337] binder: 27334:27337 ioctl 40086602 20000000 returned -22 [ 1787.959680][T27333] binder: 27326:27333 ioctl 40086602 20000000 returned -22 [ 1787.972881][T27343] binder: 27338:27343 ioctl 40086602 20000000 returned -22 10:17:39 executing program 1: r0 = io_uring_setup(0x6632, &(0x7f0000000000)={0x0, 0x0, 0x2}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r0, 0x13, &(0x7f0000000080)=[0x7fffffff], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x100010, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x1, 0xfffffffb) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30491d5fc10000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = io_uring_setup(0x47c1, &(0x7f00000000c0)={0x0, 0x695, 0x1000, 0x2, 0x30b}) io_uring_enter(r2, 0x3635, 0xd239, 0x6, &(0x7f0000000000)={[0x1]}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r4, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffffe}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000035}, 0x8000) syz_genetlink_get_family_id$team(&(0x7f0000000280), r3) 10:17:39 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:39 executing program 1: r0 = io_uring_setup(0x6632, &(0x7f0000000000)={0x0, 0x0, 0x2}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r0, 0x13, &(0x7f0000000080)=[0x7fffffff], 0x2) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x100010, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) (async, rerun: 64) mknodat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x1, 0xfffffffb) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30491d5fc10000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r2 = io_uring_setup(0x47c1, &(0x7f00000000c0)={0x0, 0x695, 0x1000, 0x2, 0x30b}) io_uring_enter(r2, 0x3635, 0xd239, 0x6, &(0x7f0000000000)={[0x1]}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) (async) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r4, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffffe}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000035}, 0x8000) syz_genetlink_get_family_id$team(&(0x7f0000000280), r3) [ 1787.989119][T27345] binder: 27342:27345 ioctl 401c5820 20000000 returned -22 [ 1787.993193][T27346] binder: 27344:27346 ioctl 401c5820 20000000 returned -22 [ 1787.998496][T27348] binder: 27347:27348 ioctl 40086602 20000000 returned -22 10:17:39 executing program 1: r0 = io_uring_setup(0x6632, &(0x7f0000000000)={0x0, 0x0, 0x2}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r0, 0x13, &(0x7f0000000080)=[0x7fffffff], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x100010, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mknodat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x1, 0xfffffffb) (async) mknodat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0x1, 0xfffffffb) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="79797a746e6c30491d5fc10000000000", @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) io_uring_setup(0x47c1, &(0x7f00000000c0)={0x0, 0x695, 0x1000, 0x2, 0x30b}) (async) r2 = io_uring_setup(0x47c1, &(0x7f00000000c0)={0x0, 0x695, 0x1000, 0x2, 0x30b}) io_uring_enter(r2, 0x3635, 0xd239, 0x6, &(0x7f0000000000)={[0x1]}, 0x8) (async) io_uring_enter(r2, 0x3635, 0xd239, 0x6, &(0x7f0000000000)={[0x1]}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000780), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x24, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x5}, @BATADV_ATTR_GW_MODE={0x5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r4, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xfffffffe}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000035}, 0x8000) syz_genetlink_get_family_id$team(&(0x7f0000000280), r3) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406305, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.033759][T27354] binder: 27353:27354 ioctl 401c5820 20000000 returned -22 [ 1788.038125][T27360] binder: 27355:27360 ioctl 40086602 20000000 returned -22 [ 1788.041556][T27362] binder: 27357:27362 ioctl 401c5820 20000000 returned -22 [ 1788.054914][T27358] binder: 27356:27358 ioctl 401c5820 20000000 returned -22 [ 1788.063624][T27367] binder: 27352:27367 ioctl 40086602 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x2000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r1, 0x8000000) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/252) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r1, 0x8000000) (async) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/252) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406306, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.086782][T27373] binder: 27371:27373 ioctl 40086602 20000000 returned -22 [ 1788.091877][T27376] binder: 27374:27376 ioctl 401c5820 20000000 returned -22 [ 1788.102219][T27377] binder: 27375:27377 ioctl 401c5820 20000000 returned -22 [ 1788.112383][T27379] binder: 27378:27379 ioctl 40086602 20000000 returned -22 [ 1788.128713][T27383] binder: 27382:27383 ioctl 401c5820 200004c0 returned -22 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r1, 0x8000000) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/252) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000002, 0x13, r1, 0x8000000) (async) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f00000000c0)=""/252) (async) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x3000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.143840][T27391] binder: 27381:27391 ioctl 401c5820 20000000 returned -22 [ 1788.147902][T27392] binder: 27380:27392 ioctl 401c5820 20000000 returned -22 [ 1788.160201][T27390] binder: 27387:27390 ioctl 40086602 20000000 returned -22 [ 1788.172156][T27397] binder: 27396:27397 ioctl 40086602 20000000 returned -22 [ 1788.173299][T27398] binder: 27395:27398 ioctl 401c5820 200004c0 returned -22 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00136bdcd8a3a3fc000045030014006400201f290000d97eaaff97c8930000000067b9aa554a7b76f6d0ef2aba6ccc9e50835101cb708fedf01815db4a239560e81cc1301dd3b16fd717d840ad8d36ab7a49b29d874e8c4b0457b9258ae1"]}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00136bdcd8a3a3fc000045030014006400201f290000d97eaaff97c8930000000067b9aa554a7b76f6d0ef2aba6ccc9e50835101cb708fedf01815db4a239560e81cc1301dd3b16fd717d840ad8d36ab7a49b29d874e8c4b0457b9258ae1"]}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406308, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.193808][T27404] binder: 27403:27404 ioctl 401c5820 20000000 returned -22 [ 1788.201365][T27406] binder: 27399:27406 ioctl 401c5820 20000000 returned -22 [ 1788.203664][T27407] binder: 27405:27407 ioctl 40086602 20000000 returned -22 [ 1788.211261][T27409] binder: 27408:27409 ioctl 40086602 20000000 returned -22 [ 1788.228818][T27413] binder: 27410:27413 ioctl 401c5820 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x401c5820, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x5000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00136bdcd8a3a3fc000045030014006400201f290000d97eaaff97c8930000000067b9aa554a7b76f6d0ef2aba6ccc9e50835101cb708fedf01815db4a239560e81cc1301dd3b16fd717d840ad8d36ab7a49b29d874e8c4b0457b9258ae1"]}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x2b, 0x2, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x4, 0xf7, 0x1, 0xa, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x24}, 0x20, 0x20, 0x28b3, 0x4}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f0000000440)=ANY=[@ANYBLOB="1819895510d9b463cd390000ce00000be3", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6}, 0x90) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x48, r3, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xe4f9}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="f5ca002f3473"}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7cb1}]}, 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x20048080) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="2ac16830bc", @ANYRES32, @ANYRES64=r4]}) r7 = gettid() r8 = gettid() sched_setattr(r8, &(0x7f0000000400)={0x38, 0x3, 0xc, 0x3, 0x200, 0x2000000, 0x1f, 0x4, 0x9, 0x4}, 0x0) capget(&(0x7f0000000000)={0x19980330, r7}, &(0x7f00000000c0)={0x9, 0x5, 0x3f, 0x800, 0x0, 0xff}) [ 1788.247941][T27416] binder: 27414:27416 ioctl 401c5820 20000000 returned -22 [ 1788.263287][T27423] binder: 27422:27423 ioctl 40086602 20000000 returned -22 [ 1788.263324][T27424] binder: 27421:27424 ioctl 401c5820 20000000 returned -22 [ 1788.275874][T27425] binder: 27420:27425 ioctl 401c5820 200004c0 returned -22 [ 1788.277416][T27418] binder: 27417:27418 ioctl 40086602 20000000 returned -22 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x2b, 0x2, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x4, 0xf7, 0x1, 0xa, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x24}, 0x20, 0x20, 0x28b3, 0x4}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f0000000440)=ANY=[@ANYBLOB="1819895510d9b463cd390000ce00000be3", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6}, 0x90) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x48, r3, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xe4f9}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="f5ca002f3473"}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7cb1}]}, 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x20048080) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="2ac16830bc", @ANYRES32, @ANYRES64=r4]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="2ac16830bc", @ANYRES32, @ANYRES64=r4]}) gettid() (async) r7 = gettid() r8 = gettid() sched_setattr(r8, &(0x7f0000000400)={0x38, 0x3, 0xc, 0x3, 0x200, 0x2000000, 0x1f, 0x4, 0x9, 0x4}, 0x0) capget(&(0x7f0000000000)={0x19980330, r7}, &(0x7f00000000c0)={0x9, 0x5, 0x3f, 0x800, 0x0, 0xff}) (async) capget(&(0x7f0000000000)={0x19980330, r7}, &(0x7f00000000c0)={0x9, 0x5, 0x3f, 0x800, 0x0, 0xff}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1788.317050][T27433] binder: 27432:27433 ioctl 401c5820 20000000 returned -22 [ 1788.319002][T27435] binder: 27434:27435 ioctl 40086602 20000000 returned -22 [ 1788.324425][T27431] binder: 27429:27431 ioctl 401c5820 20000000 returned -22 [ 1788.350783][T27441] binder: 27440:27441 ioctl 40086602 20000000 returned -22 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x8000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x2b, 0x2, 0x3, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x4, 0xf7, 0x1, 0xa, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x24}, 0x20, 0x20, 0x28b3, 0x4}}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f0000000440)=ANY=[@ANYBLOB="1819895510d9b463cd390000ce00000be3", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6}, 0x90) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x48, r3, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xe4f9}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="f5ca002f3473"}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7cb1}]}, 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x20048080) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="2ac16830bc", @ANYRES32, @ANYRES64=r4]}) r7 = gettid() r8 = gettid() sched_setattr(r8, &(0x7f0000000400)={0x38, 0x3, 0xc, 0x3, 0x200, 0x2000000, 0x1f, 0x4, 0x9, 0x4}, 0x0) capget(&(0x7f0000000000)={0x19980330, r7}, &(0x7f00000000c0)={0x9, 0x5, 0x3f, 0x800, 0x0, 0xff}) socket$inet_udp(0x2, 0x2, 0x0) (async) socketpair(0x2b, 0x2, 0x3, &(0x7f0000000100)) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r1) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x4, 0xf7, 0x1, 0xa, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x24}, 0x20, 0x20, 0x28b3, 0x4}}) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00'}) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f0000000440)=ANY=[@ANYBLOB="1819895510d9b463cd390000ce00000be3", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r6}, 0x90) (async) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x48, r3, 0x10, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xe4f9}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="f5ca002f3473"}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7cb1}]}, 0x48}, 0x1, 0x0, 0x0, 0x840}, 0x20048080) (async) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000140), &(0x7f0000000180)=0x4) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="2ac16830bc", @ANYRES32, @ANYRES64=r4]}) (async) gettid() (async) gettid() (async) sched_setattr(r8, &(0x7f0000000400)={0x38, 0x3, 0xc, 0x3, 0x200, 0x2000000, 0x1f, 0x4, 0x9, 0x4}, 0x0) (async) capget(&(0x7f0000000000)={0x19980330, r7}, &(0x7f00000000c0)={0x9, 0x5, 0x3f, 0x800, 0x0, 0xff}) (async) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.371373][T27445] binder: 27444:27445 ioctl 401c5820 20000000 returned -22 [ 1788.377931][T27450] binder: 27449:27450 ioctl 40086602 20000000 returned -22 [ 1788.386445][T27451] binder: 27446:27451 ioctl 401c5820 20000000 returned -22 [ 1788.387383][T27453] binder: 27452:27453 ioctl 40086602 20000000 returned -22 [ 1788.408544][T27458] binder: 27456:27458 ioctl 40086602 20000000 returned -22 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x9000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040630b, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_io_uring_complete(0x0) mknodat$null(r1, &(0x7f0000000000)='./file0\x00', 0x8000, 0x103) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xa000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.424543][T27463] binder: 27462:27463 ioctl 401c5820 20000000 returned -22 [ 1788.436739][T27465] binder: 27464:27465 ioctl 401c5820 20000000 returned -22 [ 1788.448615][T27481] binder: 27480:27481 ioctl 40086602 20000000 returned -22 [ 1788.458867][T27484] binder: 27483:27484 ioctl 40086602 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040630c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r1 = syz_io_uring_complete(0x0) mknodat$null(r1, &(0x7f0000000000)='./file0\x00', 0x8000, 0x103) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xb000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.475079][T27488] binder: 27487:27488 ioctl 401c5820 20000000 returned -22 [ 1788.485854][T27492] binder: 27491:27492 ioctl 40086602 20000000 returned -22 [ 1788.489284][T27495] binder: 27494:27495 ioctl 40086602 20000000 returned -22 [ 1788.495488][T27496] binder: 27493:27496 ioctl 401c5820 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xc000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = syz_io_uring_complete(0x0) mknodat$null(r1, &(0x7f0000000000)='./file0\x00', 0x8000, 0x103) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) syz_io_uring_complete(0x0) (async) mknodat$null(r1, &(0x7f0000000000)='./file0\x00', 0x8000, 0x103) (async) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.526762][T27504] binder: 27501:27504 ioctl 40086602 20000000 returned -22 [ 1788.527243][T27505] binder: 27500:27505 ioctl 401c5820 20000000 returned -22 [ 1788.547064][T27507] binder: 27503:27507 ioctl 40086602 20000000 returned -22 [ 1788.547065][T27511] binder: 27509:27511 ioctl 401c5820 20000000 returned -22 [ 1788.569251][T27515] binder: 27514:27515 ioctl 40086602 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xd000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.578295][T27521] binder: 27519:27521 ioctl 401c5820 20000000 returned -22 [ 1788.585879][T27518] binder: 27517:27518 ioctl 40086602 20000000 returned -22 [ 1788.616145][T27528] binder: 27527:27528 ioctl 401c5820 20000000 returned -22 10:17:40 executing program 5: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1788.631392][T27530] binder: 27529:27530 ioctl 40086602 20000000 returned -22 [ 1788.646487][T27535] binder: 27534:27535 ioctl 401c5820 20000000 returned -22 [ 1788.664303][T27539] binder: 27538:27539 ioctl 40086602 20000000 returned -22 10:17:40 executing program 5: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xe000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.677759][T27541] binder: 27540:27541 ioctl 401c5820 20000000 returned -22 [ 1788.685741][T27545] binder: 27544:27545 ioctl 401c5820 20000000 returned -22 [ 1788.705810][T27547] binder: 27546:27547 ioctl 40086602 20000000 returned -22 [ 1788.721634][T27551] binder: 27550:27551 ioctl 40086602 20000000 returned -22 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x10000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1788.732744][T27554] binder: 27552:27554 ioctl 401c5820 20000000 returned -22 [ 1788.743597][T27556] binder: 27555:27556 ioctl 401c5820 20000000 returned -22 [ 1788.759310][T27560] binder: 27558:27560 ioctl 40086602 20000000 returned -22 [ 1788.774800][T27565] binder: 27564:27565 ioctl 40086602 20000000 returned -22 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x11000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406318, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.778759][T27567] binder: 27566:27567 ioctl 401c5820 20000000 returned -22 [ 1788.810197][T27571] binder: 27570:27571 ioctl 401c5820 20000000 returned -22 [ 1788.824267][T27575] binder: 27573:27575 ioctl 40086602 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000240)={'gre0\x00', 0x0, 0x10, 0x40, 0x81, 0x5, {{0x16, 0x4, 0x1, 0xa, 0x58, 0x68, 0x0, 0x8, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0xc}, @remote, {[@timestamp_addr={0x44, 0x44, 0xa3, 0x1, 0xe, [{@rand_addr=0x64010101, 0x10000}, {@loopback, 0x3}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x3}, {@loopback, 0x9}, {@rand_addr=0x64010101, 0x2}, {@loopback, 0x4}, {@multicast1, 0x1ff}, {@remote, 0x8001}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x1f, 0x2, 0x41, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x8, 0x8, 0x8, 0xa84}}) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f00000000c0)=@raw=[@map_fd], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r7}, 0x90) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000005c0)={'gretap0\x00', &(0x7f0000000480)={'syztnl1\x00', 0x0, 0x20, 0x700, 0x5f2ffcfd, 0x7, {{0x3a, 0x4, 0x2, 0x5, 0xe8, 0x68, 0x0, 0x1, 0x4, 0x0, @local, @remote, {[@cipso={0x86, 0x13, 0x0, [{0x0, 0x3, "d3"}, {0x1, 0x7, "b82b85cae4"}, {0x5, 0x3, "d0"}]}, @end, @ssrr={0x89, 0x7, 0x91, [@multicast2]}, @timestamp={0x44, 0xc, 0x54, 0x0, 0x4, [0x1, 0x3]}, @timestamp_addr={0x44, 0x3c, 0xf5, 0x1, 0xb, [{@empty, 0x2472}, {@multicast2, 0xffffc8b4}, {@multicast1, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@remote, 0x9}, {@rand_addr=0x64010100, 0x8}, {@multicast1, 0xfffff637}]}, @ssrr={0x89, 0x1b, 0x31, [@loopback, @empty, @empty, @dev={0xac, 0x14, 0x14, 0x12}, @broadcast, @multicast2]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x14, 0xa3, 0x3, 0x2, [{@empty, 0x9}, {@multicast2, 0x80000001}]}, @timestamp_prespec={0x44, 0x3c, 0x5b, 0x3, 0xa, [{@broadcast, 0x6}, {@private=0xa010102, 0x7}, {@local, 0x25}, {@loopback}, {@multicast1, 0xdc}, {@rand_addr=0x64010100, 0x7}, {@loopback, 0xffffffff}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000680)={'syztnl2\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x29, 0xfc, 0x5, 0x9, 0x350aa7b9db0a4042, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}, 0x700, 0x7800, 0x0, 0x8}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000700)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6_vti0\x00', &(0x7f0000000740)={'ip6_vti0\x00', 0x0, 0x4, 0xff, 0xc8, 0x8001, 0x6, @local, @private2, 0x80, 0x7ecee637c00b0e0b, 0x6, 0x4}}) r14 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r14, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', r15}, 0x48) r16 = socket$inet6_udplite(0xa, 0x2, 0x88) r17 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r16, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r17, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r18, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000800)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000940)={'erspan0\x00', &(0x7f0000000880)={'erspan0\x00', 0x0, 0x700, 0x8, 0x1, 0x7, {{0x1f, 0x4, 0x3, 0x3, 0x7c, 0x65, 0x0, 0x7b, 0x29, 0x0, @local, @loopback, {[@rr={0x7, 0x17, 0xf2, [@local, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @remote]}, @ssrr={0x89, 0x7, 0xb8, [@rand_addr=0x64010101]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x3c, 0xe7, 0x3, 0x9, [{@multicast2}, {@multicast2, 0x1}, {@rand_addr=0x64010102, 0x6}, {@multicast1, 0x7}, {@local, 0x6}, {@empty, 0xf35}, {@rand_addr=0x64010100, 0x69e}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000980)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000a40)={'erspan0\x00', &(0x7f00000009c0)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00800008ffffffff00000fff400400400066000000049078e0000002ac14143e442c71410000000000000004ac1e010100000008ac14140b0000007f7f000001000007d3ac1414bb00000000"]}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001200)={&(0x7f0000000a80)={0x744, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [{{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9c}}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x174, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xca}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9f4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x128, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x20}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r9}, {0xec, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfbb}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r11}}}]}}, {{0x8, 0x1, r12}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0x3, 0xc3}, {0x5f02, 0x8, 0x7f, 0x9}]}}}]}}, {{0x8, 0x1, r13}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r15}}}]}}, {{0x8}, {0x1a4, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x0, 0x8, 0xf9, 0x9}, {0x9c, 0x4, 0x3, 0x3}, {0x52, 0x48, 0xde, 0x401}, {0x9, 0x5, 0x20, 0x7}, {0xffff, 0xbd, 0xfa, 0x8}, {0x8, 0x0, 0x20, 0x5}, {0x6, 0x1, 0x40, 0xff}, {0x1ff, 0x0, 0x6, 0x80000001}, {0x8, 0x1f, 0x1, 0x1}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r20}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r21}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r22}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r23}}}]}}]}, 0x744}, 0x1, 0x0, 0x0, 0x10}, 0x48051) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406325, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x12000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406348, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.830283][T27577] binder: 27576:27577 ioctl 401c5820 20000000 returned -22 [ 1788.838736][T27574] binder: 27572:27574 ioctl 40086602 20000000 returned -22 [ 1788.856853][T27583] binder: 27580:27583 ioctl 401c5820 20000000 returned -22 [ 1788.867300][T27585] binder: 27584:27585 ioctl 40086602 20000000 returned -22 [ 1788.871570][T27582] binder: 27581:27582 ioctl 401c5820 20000000 returned -22 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x18000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000240)={'gre0\x00', 0x0, 0x10, 0x40, 0x81, 0x5, {{0x16, 0x4, 0x1, 0xa, 0x58, 0x68, 0x0, 0x8, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0xc}, @remote, {[@timestamp_addr={0x44, 0x44, 0xa3, 0x1, 0xe, [{@rand_addr=0x64010101, 0x10000}, {@loopback, 0x3}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x3}, {@loopback, 0x9}, {@rand_addr=0x64010101, 0x2}, {@loopback, 0x4}, {@multicast1, 0x1ff}, {@remote, 0x8001}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x1f, 0x2, 0x41, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x8, 0x8, 0x8, 0xa84}}) (async) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f00000000c0)=@raw=[@map_fd], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r7}, 0x90) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000005c0)={'gretap0\x00', &(0x7f0000000480)={'syztnl1\x00', 0x0, 0x20, 0x700, 0x5f2ffcfd, 0x7, {{0x3a, 0x4, 0x2, 0x5, 0xe8, 0x68, 0x0, 0x1, 0x4, 0x0, @local, @remote, {[@cipso={0x86, 0x13, 0x0, [{0x0, 0x3, "d3"}, {0x1, 0x7, "b82b85cae4"}, {0x5, 0x3, "d0"}]}, @end, @ssrr={0x89, 0x7, 0x91, [@multicast2]}, @timestamp={0x44, 0xc, 0x54, 0x0, 0x4, [0x1, 0x3]}, @timestamp_addr={0x44, 0x3c, 0xf5, 0x1, 0xb, [{@empty, 0x2472}, {@multicast2, 0xffffc8b4}, {@multicast1, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@remote, 0x9}, {@rand_addr=0x64010100, 0x8}, {@multicast1, 0xfffff637}]}, @ssrr={0x89, 0x1b, 0x31, [@loopback, @empty, @empty, @dev={0xac, 0x14, 0x14, 0x12}, @broadcast, @multicast2]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x14, 0xa3, 0x3, 0x2, [{@empty, 0x9}, {@multicast2, 0x80000001}]}, @timestamp_prespec={0x44, 0x3c, 0x5b, 0x3, 0xa, [{@broadcast, 0x6}, {@private=0xa010102, 0x7}, {@local, 0x25}, {@loopback}, {@multicast1, 0xdc}, {@rand_addr=0x64010100, 0x7}, {@loopback, 0xffffffff}]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000680)={'syztnl2\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x29, 0xfc, 0x5, 0x9, 0x350aa7b9db0a4042, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}, 0x700, 0x7800, 0x0, 0x8}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000700)={'team0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6_vti0\x00', &(0x7f0000000740)={'ip6_vti0\x00', 0x0, 0x4, 0xff, 0xc8, 0x8001, 0x6, @local, @private2, 0x80, 0x7ecee637c00b0e0b, 0x6, 0x4}}) (async) r14 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r14, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', r15}, 0x48) (async) r16 = socket$inet6_udplite(0xa, 0x2, 0x88) r17 = socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r16, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r17, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r18, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000800)={'batadv_slave_1\x00', 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000940)={'erspan0\x00', &(0x7f0000000880)={'erspan0\x00', 0x0, 0x700, 0x8, 0x1, 0x7, {{0x1f, 0x4, 0x3, 0x3, 0x7c, 0x65, 0x0, 0x7b, 0x29, 0x0, @local, @loopback, {[@rr={0x7, 0x17, 0xf2, [@local, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @remote]}, @ssrr={0x89, 0x7, 0xb8, [@rand_addr=0x64010101]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x3c, 0xe7, 0x3, 0x9, [{@multicast2}, {@multicast2, 0x1}, {@rand_addr=0x64010102, 0x6}, {@multicast1, 0x7}, {@local, 0x6}, {@empty, 0xf35}, {@rand_addr=0x64010100, 0x69e}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000980)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000a40)={'erspan0\x00', &(0x7f00000009c0)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00800008ffffffff00000fff400400400066000000049078e0000002ac14143e442c71410000000000000004ac1e010100000008ac14140b0000007f7f000001000007d3ac1414bb00000000"]}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001200)={&(0x7f0000000a80)={0x744, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [{{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9c}}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x174, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xca}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9f4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x128, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x20}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r9}, {0xec, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfbb}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r11}}}]}}, {{0x8, 0x1, r12}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0x3, 0xc3}, {0x5f02, 0x8, 0x7f, 0x9}]}}}]}}, {{0x8, 0x1, r13}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r15}}}]}}, {{0x8}, {0x1a4, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x0, 0x8, 0xf9, 0x9}, {0x9c, 0x4, 0x3, 0x3}, {0x52, 0x48, 0xde, 0x401}, {0x9, 0x5, 0x20, 0x7}, {0xffff, 0xbd, 0xfa, 0x8}, {0x8, 0x0, 0x20, 0x5}, {0x6, 0x1, 0x40, 0xff}, {0x1ff, 0x0, 0x6, 0x80000001}, {0x8, 0x1f, 0x1, 0x1}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r20}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r21}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r22}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r23}}}]}}]}, 0x744}, 0x1, 0x0, 0x0, 0x10}, 0x48051) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040634c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.889607][T27590] binder: 27589:27590 ioctl 40086602 20000000 returned -22 [ 1788.889803][T27593] binder: 27592:27593 ioctl 40086602 20000000 returned -22 [ 1788.916748][T27596] binder: 27594:27596 ioctl 40086602 20000000 returned -22 [ 1788.923429][T27600] binder: 27598:27600 ioctl 401c5820 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x25000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000200)={'team0\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000240)={'gre0\x00', 0x0, 0x10, 0x40, 0x81, 0x5, {{0x16, 0x4, 0x1, 0xa, 0x58, 0x68, 0x0, 0x8, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0xc}, @remote, {[@timestamp_addr={0x44, 0x44, 0xa3, 0x1, 0xe, [{@rand_addr=0x64010101, 0x10000}, {@loopback, 0x3}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x3}, {@loopback, 0x9}, {@rand_addr=0x64010101, 0x2}, {@loopback, 0x4}, {@multicast1, 0x1ff}, {@remote, 0x8001}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000400)={'ip6gre0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x1f, 0x2, 0x41, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, 0x8, 0x8, 0x8, 0xa84}}) (async) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x2, &(0x7f00000000c0)=@raw=[@map_fd], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r7}, 0x90) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000440)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000005c0)={'gretap0\x00', &(0x7f0000000480)={'syztnl1\x00', 0x0, 0x20, 0x700, 0x5f2ffcfd, 0x7, {{0x3a, 0x4, 0x2, 0x5, 0xe8, 0x68, 0x0, 0x1, 0x4, 0x0, @local, @remote, {[@cipso={0x86, 0x13, 0x0, [{0x0, 0x3, "d3"}, {0x1, 0x7, "b82b85cae4"}, {0x5, 0x3, "d0"}]}, @end, @ssrr={0x89, 0x7, 0x91, [@multicast2]}, @timestamp={0x44, 0xc, 0x54, 0x0, 0x4, [0x1, 0x3]}, @timestamp_addr={0x44, 0x3c, 0xf5, 0x1, 0xb, [{@empty, 0x2472}, {@multicast2, 0xffffc8b4}, {@multicast1, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@remote, 0x9}, {@rand_addr=0x64010100, 0x8}, {@multicast1, 0xfffff637}]}, @ssrr={0x89, 0x1b, 0x31, [@loopback, @empty, @empty, @dev={0xac, 0x14, 0x14, 0x12}, @broadcast, @multicast2]}, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x14, 0xa3, 0x3, 0x2, [{@empty, 0x9}, {@multicast2, 0x80000001}]}, @timestamp_prespec={0x44, 0x3c, 0x5b, 0x3, 0xa, [{@broadcast, 0x6}, {@private=0xa010102, 0x7}, {@local, 0x25}, {@loopback}, {@multicast1, 0xdc}, {@rand_addr=0x64010100, 0x7}, {@loopback, 0xffffffff}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000680)={'syztnl2\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x29, 0xfc, 0x5, 0x9, 0x350aa7b9db0a4042, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}, 0x700, 0x7800, 0x0, 0x8}}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000700)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6_vti0\x00', &(0x7f0000000740)={'ip6_vti0\x00', 0x0, 0x4, 0xff, 0xc8, 0x8001, 0x6, @local, @private2, 0x80, 0x7ecee637c00b0e0b, 0x6, 0x4}}) r14 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r14, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', r15}, 0x48) (async) r16 = socket$inet6_udplite(0xa, 0x2, 0x88) r17 = socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r16, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r17, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r18, @ANYBLOB="00000080000031f10000000645030014006400001f2990787f000001e0000002"]}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000800)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000940)={'erspan0\x00', &(0x7f0000000880)={'erspan0\x00', 0x0, 0x700, 0x8, 0x1, 0x7, {{0x1f, 0x4, 0x3, 0x3, 0x7c, 0x65, 0x0, 0x7b, 0x29, 0x0, @local, @loopback, {[@rr={0x7, 0x17, 0xf2, [@local, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @remote]}, @ssrr={0x89, 0x7, 0xb8, [@rand_addr=0x64010101]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x3c, 0xe7, 0x3, 0x9, [{@multicast2}, {@multicast2, 0x1}, {@rand_addr=0x64010102, 0x6}, {@multicast1, 0x7}, {@local, 0x6}, {@empty, 0xf35}, {@rand_addr=0x64010100, 0x69e}]}, @ra={0x94, 0x4}, @ra={0x94, 0x4}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000980)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000a40)={'erspan0\x00', &(0x7f00000009c0)=ANY=[@ANYBLOB='syztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00800008ffffffff00000fff400400400066000000049078e0000002ac14143e442c71410000000000000004ac1e010100000008ac14140b0000007f7f000001000007d3ac1414bb00000000"]}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001200)={&(0x7f0000000a80)={0x744, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [{{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9c}}, {0x8}}}]}}, {{0x8, 0x1, r1}, {0x174, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xca}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x9f4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8, 0x1, r4}, {0x128, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x20}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r9}, {0xec, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xfbb}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r11}}}]}}, {{0x8, 0x1, r12}, {0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x3, 0x3, 0xc3}, {0x5f02, 0x8, 0x7f, 0x9}]}}}]}}, {{0x8, 0x1, r13}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r15}}}]}}, {{0x8}, {0x1a4, 0x2, 0x0, 0x1, [{0x7c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4c, 0x4, [{0x0, 0x8, 0xf9, 0x9}, {0x9c, 0x4, 0x3, 0x3}, {0x52, 0x48, 0xde, 0x401}, {0x9, 0x5, 0x20, 0x7}, {0xffff, 0xbd, 0xfa, 0x8}, {0x8, 0x0, 0x20, 0x5}, {0x6, 0x1, 0x40, 0xff}, {0x1ff, 0x0, 0x6, 0x80000001}, {0x8, 0x1f, 0x1, 0x1}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r20}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r21}, {0xbc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r22}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r23}}}]}}]}, 0x744}, 0x1, 0x0, 0x0, 0x10}, 0x48051) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x48000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406368, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1788.934359][T27601] binder: 27599:27601 ioctl 401c5820 20000000 returned -22 [ 1788.943586][T27610] binder: 27602:27610 ioctl 40086602 20000000 returned -22 [ 1788.958725][T27613] binder: 27611:27613 ioctl 40086602 20000000 returned -22 [ 1788.966587][T27617] binder: 27616:27617 ioctl 401c5820 20000000 returned -22 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x800, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40c0}, 0x0) 10:17:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040636c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x800, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40c0}, 0x0) [ 1788.985774][T27622] binder: 27621:27622 ioctl 40086602 20000000 returned -22 [ 1788.991808][T27627] binder: 27626:27627 ioctl 401c5820 20000000 returned -22 [ 1789.004237][T27625] binder: 27620:27625 ioctl 40086602 20000000 returned -22 [ 1789.017952][T27629] binder: 27628:27629 ioctl 401c5820 20000000 returned -22 [ 1789.032860][T27635] binder: 27634:27635 ioctl 40086602 20000000 returned -22 10:17:40 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4c000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, r0, 0x8000000) 10:17:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406374, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:40 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:40 executing program 1: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r1, 0x800, 0x70bd2b, 0x25dfdbfd, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40c0}, 0x0) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000000c0)='%pB \x00'}, 0x20) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="b1cb73d9b4493cde6c29476170b02e903fe6dd2df8a77c681c858c951998c9c5e05e82f1bb386fff77d7d527b9da10d69effd013463a0f251db11e7385260cbef2c0ec5634d8708ccbcc002cdb6d2003ab57e5ac384fe6341e2abbcea5972f8174a6c5545a2c84a6149838454f7be4444512076ce7593bdc0e04bfbdb6f26ef5062b8c07f2ea90d77edb33dc02ba80be0e5b506f019231a76d938a6cdc1a09c1", 0xa0, 0xfffffffffffffffb) r3 = add_key$user(&(0x7f0000000080), 0x0, &(0x7f0000000100)="9332b53640dfd200c99a40d382885199f9f2f4518894f72c2e8c", 0x1a, 0xfffffffffffffffa) r4 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$dh_compute(0x17, &(0x7f0000000300)={r3, 0x0, r4}, &(0x7f0000000340)=""/105, 0x69, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000340)={0x0, r2, r4}, &(0x7f0000000380)=""/54, 0x36, &(0x7f0000000400)={&(0x7f00000003c0)={'sha3-512-generic\x00'}}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x121000, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x7, '\x00', 0x0, r5, 0x0, 0x4, 0x2}, 0x48) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x20002, 0x0) r7 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x1) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000017c0)={0xc4, 0x0, &(0x7f00000006c0)=[@decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000540)={@fda={0x66646185, 0x9, 0x0, 0x32}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/191, 0xbf, 0x1, 0x20}}, &(0x7f00000005c0)={0x0, 0x20, 0x38}}}, @free_buffer={0x40086303, r7}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000600)={@fd, @flat=@handle={0x73682a85, 0x100a, 0x1}, @flat=@binder={0x73622a85, 0x10a, 0x1}}, &(0x7f0000000680)={0x0, 0x18, 0x30}}, 0x40}, @increfs={0x40046304, 0x2}, @register_looper, @acquire_done], 0x1000, 0x0, &(0x7f00000007c0)="a47d8e1a09270e43f46f7eb5fa4414c1fa5e1cd82a1ee2c51761ef06fbd3ef65cc106755f72d9dcb44e4158bb8d0f19a2f363e13fcf0d166be46cd1af35f4f24c40393c9e91325bf842874818bfc4df6f79431fe2262684b8f27e61632d976a519a956821bf727b04076fe73455370c9fd20a84298f3e2048f5f9f9f299e9efe69275c09a1e20fa24cdf26ec90183e5055b7778859de305f48115e9837f7731b224c1f24dc080ff5cc4f1d4a0b01e8d0ff737555bebd139975e9e233d443452537144f05f09ceb7fb9b12e96c5f1032fe6e01a5ca9a012198b1ff2d5e836674546f4993e60fbc2a13754f84080984fc8d6adf05d73e40917c585a5ac47669c9c8edfbc24e7c77198f9d2ad6982166006756cd6d38140d206b05678ebff8e9b5f573e5cad89e017743d4bae5fdb1a989123904b585a3d0f38cfaaf1b62d39d9af78cafe3c0505e2fcf3ef5d53970dcfee607300cbd7d7388d28ab83c16b7f8d8d51ffcaefbd9eb6bb586052bde5a5bb79b2cb264ccced28a1fcd5d2f201806939f744128cdb8712672b046bcc621901b3a51fdbfd6308d4646b4ef1deb72ad67e4a18b48b2654c83c56669f6153446e9de7cf4d14014d8cf4150ca4e80069ecc219da6b57f502c7cd2211716a4edd82efd772aff7451b5db33f2d46b184b4048781231e407f01276fc8aaac9182712d7ba7e74f99cab2f89a6fbfb0e1f0f1aedff3b908f6af340aedf286746bd7a4bf19e8bcecf504c159e96fcd845dcb6d771a98a9a720f30a0dfdcafa6936a58b34d60f9a5c7db6fa0b88793e513005e78a4a77cad1b02a5a4391c65c3e5097f108787989d8576f08ec86e2b21bc4cc9fdb746bee8e0af3e61a2cfda7617d067f4188eb6dd8f50e9f63ce1d47664e91d50a878919201d7969b96c8511618ac2f31b996f36580f7caceed0adf81f5f2bb23ec5b738e9c41089c7598ce0d07cdb0420cd137c17d7ed8fa057643c7cd13bcaea87473d51680c29fdcd6b1480ea3b7133e9e3c11c044ad807562cc2b19b09eddcec17347c50d955bea9926519d6cac205593ff8ab771faf6170812642e388f58c50c8c60b2ca2d9a8c5e98c09bce3d8c1ad53680ec7b3c2ce7fd7d5b948af1cc9f72e37c2dc92f040129a9e634a4ecf9d5efbb30650c00624991dbccf516c0dd17acba8d9bd79799b43dc717ed2c855b060f867284594347209176c0885b7348e965735adc01ee0a1e5598f1b9ddb2da550e041c20f4bc5edcb837692610ca2de99c7481b62d62514a119cca7416829662d18d4717b5b89a2891776c78ec49ca393636e725e145ea9e2c00b4bb76cfba09e39b804c09b4917f0040fa13bfc689171cdde6bd476a44af8b8b6fa6277f7439d536e891e5634cafaa33d06826aa4aa2b2ef64df88c5c3f325b988e14b50aa1810cf232e058aeb929f88344d000a0414f72f483d1cce8ecb7d620889528f693742015db0d7a2ecebdd28d750a26d09bda87bfc004ca7a90f19149400826310ca169dd2e08f7f0a37f3fe050e7fe53571e8119f48552e776ec43ca4d52c29a8978611b42a37072130b028d536ec47635a31a005dd7799e22658f8bd7e029764d7753442bb18178ca11b2ddede70b53473dfa8861b51a58c3b7c5edac38ed4078ee3323c6d15ce2ad8ddf6bfcac28f273ddf8e9849cd59f1a69e555c75f80cd141d1c3cc5e16701e58b95dbcf185648700c8dc7c3f7a7b5761498668da8bb3df17ddea6d47a74da7267401e048b37817eccb6748c03880fa04f0c04c8c976863e1a618605caa57b2ded2b7af7bac6f3d058baf5b6436920074609c90020d5216e55cb89cb70606d4050f453f2c360137edbb1727ee73677fb39d15378b07b5aba7f9ca4c40adcd1d1bcb342e449f5021e24d6e52d085db59935e559b61aaa03ac96162d911435b357f71385aed6474feb513f6d47e47d1837fc980c4937478624890c28c8119a471ef93b49d386fdf36d7bae1520bea2c18a64b016283bb7a8b243f100d822bc3ef2e073943f1845bebb43970ce13f4bf82589ff5d3ec502d8536b45202e19d048a831d5eedb7e930f636c53c9fce4c208e63e1bb179ab46fb99514e4fd70ebc9481f98b2bc79a4a9ad6b8c6fa08ab9f887b8b34e7606db59eaf97a128efe78c2a98b8c6d4938c651a19a288d3e41a284e5dedf9773264b567920910beb6528c80100c56ab05fc8866933b33375e4214ab66f807eeb569bba3b0d2493b90d41b00729f77d7d5e3552685e875ea9d50671c042c5541569a5497842a1608c686b616df92b92a2ab7baeb531f8a9aff5dfc216a2e179b1bd6cddbc30b671a7ac1134cd6098a0d167007e361ab49cc2d928b2b38af427b51fab80a95d759dd1d18ae4541ca4400fd268f0ec7335ce6862b09322a35aac1e602b3cf361d5ed9b052b25e04281653cc023c377c6d6ca2f8a8b8f3ad37bdaccf05f5e086b7b17e7b7d5c8c1a991c089984fe8d3994d9b005f167804b46e73763b4dbc3880adc8ccc658d4d165bf630948860287ba78026c5c487a7937e0d8d331359793735de4db54b1b0edaf3c8c88f88ad25731fd1d3b65d080295a872e354c0397ae472e208b1d21c8713a6160c7aedea39706746d53e19e4bc4f7fa33fa04c699340e76f7bb442cc94092fa74dfb1d8e24ef3e1fcd4b2fa6be5de95cb94affd828401fa8560b5fcb3c725e81095f7be94bb6757ee502b0390f85a75d02be92cac263fd500dd709635de8ebf227c547fcd62e6bbc87e57bce487b2624fb1ba72a3ba4de61eefabbde61293dbb58972e519e20758aa6be2e6ae95a9c34608a148860c0899634b393efd6ece8819133ccf9625c34ccd23d1d3fe7f0cbaf4444502db0d12b94b2d2c12f5961bfdb2650a97396061f17becc175db3d716b934f69661b394c0c8af3f960c30d9696ce90cc723bde68affdb327754024cf6a44274d5844676c26ea9e272f289fc20d43a7e9e5b1032aa6cebb3515b9812478e76792f8b9ad1128f35bdcb437c75165336cb06668235c9bb5495dd91298202a6d9b2b184202e00fcd520d7b0b7cab39461b5d3666b6474560698200b3135794d37731a1f991dffb00fba1eb0acaefc7f32e513b950abd8e8ed5e3e25688a3d2d49c219de80014573830d9c92addb34514eb2d6937e5a2f79604bf6dd498f41d8d72f640a15aa87900468d17a41f3e5aa4bd192f8e90c0a55c3c73fbe28862e63d28becd78e3ab612eaeaeb6380b235ccad6bd35ef5e42e111bdddcf35a8f0c80c1280379a9b365f9c7107e7562dcee69853732cede210063c057f889ba6796163cee02a8a97497097b588e036f9c69ff3dc77263beda4f72749b49f33ecfe35838ef5961e41a0f373850419f72f3097822ffd9570741513855fa4472d7fb83a4874a257f9db8141770a0b1eb6c1c4acb36625fd6f84000d4b33328da46603c97e822ef4d4bde477c08d9b5a71ed74b85c7245e54900064d5ef289edb002b513b207f4ea7fa381a549d302ad32f97318b2867503ecebf2013bfb2b35aef9637ee9b4e8bffd49d038584c016334fa8114b385219b0c18a286d92b4a1e000e950e768de9c545be75d172dcd2a9da6147956291a88c306faf73df766b834dfa7d630e755960f03d3451c0bd7bc3d1c974a6517f07aa1991f3e0cb8f67b68d0fe104ff49abf938f67b835175347cf75a2e8274909e86505de416946989776f43a4bae448df42335e96f024435caa254fdaa09a8e162ef680331cd044faef47788ac3e6eb9618debc80a0178eb07744b40686cb04e6de36628b8ef49e7f4b33863c08d400ce6a64dbaafaab62526b2d666347715877dff80f64a322f5a344dba6566c2fff6aff825a2909a92ba6c1b50177e880726e5d1dcc3f36eea7ac15355323e0b3dd9ec716ccebcf63396636b24a22b98a36fb4f76349f40a1ea4cb4768c9f548be5272b3cec13a3727b1654e8efd6883cc7c97ecff34d04a756bf39327e442c31842f908c44b6e7a4a93f8660f14f825e3bde9156a324ca66702b405cd5e7022947cfb8f4b21b042748971bc5cb6a95c208692a9a099bd7cfc57127055a406bbb336e0769fbbf02c5432fc18282906f91a17ece90863fb8bdf20292431607d6c32ab5a0ca3cefdf9dd82c510d065f23275a1873fafec2bca587174c2dce256a45bb2f61758fe313347d8eb644fa162fe54b270a4819d2d2345ff196481babe6c666ee861198f2d828270f9a641c4de88c2d84eb73977dbe594d72d4316d3bb06d22da6838af0da630e9b652e70a0fd746d9cb0e5b16da26f2a5c71a9cb613914bb92bcffd5aac6fde4d34ce91fb44ebd6d1ca703b432962a5fc68c6679e03989021b2391251a886d7a9f3e222a586f6a2a6980c7c8e55f2d2cfeeee7fd470294736ebcbdb36eb8d1667e3603aedfa9a875ae2cbc19748f43f7166a71a5ad9d123abddbee91fdb0ea4a27f4b884cffb30d63bf9e67196f8e8920d66dcc0ff5aee4eb127efbd4d7f07629b5e46bc7cc5955dac4df42be1dab5ef59eb960fe1b5e6cc353516a66821431ea040ea65c50aa0ad4318fbf5996777ccdf4edf9e9b50a68b48d6a58ef19f715910a16d622cc4674ec85e51654a5d31d23165702fee024d4123663a7f437854d19c4c79847e3f6c5440100dab42df234b034f9d91312d3d815443fe9f60175995510e480fffd84e9b38923df51fddf5571821064f85774eb41d14cca545cc29e4cbe1dc7df86840b0e8ecff55188872e73cf394546963ac4417daed9684dc92c48f69128a28dfa60328662007a778d77531c69fcca42867fbe761fa7d53abb6f45d64f96e0e306a8ed2aadb22614726563dba1b9dc6921372cf44bd32df10437c8a7376f0b8243dab37c691220af3e60916a12ba42c9e5912583b9916dc244f3f6115474cb83dd66d5fded5af63e41e9a3110968f6c81bdd68dbab7b6e6c5bcaac8f87709a5956abe7832de08897c7e918234d3cde099f712a8d4021f63443bb4974136d6212078efc9631526ab0ed1c5455e285bda239b1f4b57680bdd7527fc36679f3ff42f81f0f2f9c49bcc835c58aeb59002ce6b3ebd849aabcc23a25f6650bf62ca2d0e392603d44e44812b6100120ff8af39fe3b6d576b76f02f7c970e4d6a643452ddd149f5fc8b5a39f307ef35383474c43d9a39c0273bcbcda55caac21ae6541b619584a3ea152d137e0b7d80c4ded9a7983385b264cff5abcec2c59560e5730c31bd7cf3970ca3910c3d426a7271bdf24d98ac68f579ffdbdb5a65401a4f0a4dd513083e14540da51f1b66aad2bbf4e9ca7893484d70d3604e2e458eea95658a9c57f8d0742b4dafce58c910a4b8766393e31be567f02c8890df1aefc9f1509275f6a35f9d00e3fa193494a02e50188b08edad24df097d48ee2d710530c3ee657bd0de37474d02735441064a16063a8f9bbbcac79787b63b3edd6cfa1b18bdc735b9071cd600f62a557590ccc1ee51cd7a505d8d3d5392bcd5fcfe4d8c9377efa5537c7e6417b8d053c79b5debfc9561905f258cf49ceb71928858fe7d48334c13d9d3cbfd1d5ba9c3fc75ccc9696ccb6916b29970905bfa3c62d75e5c42d642e8481b71b2b9e77e1eb6feb929b44ed7b876d456e02d907f24d0ccab7cfd9a9d9951c01289fc2178b2518b2be0e7f433b5d1fb693991a8b95c1379cba341c92553594a3d2470d11a86a56cffa9875bf89e0e273c8ea60a5df34ae23c8795719ba13f1be2778afa206f9af5bc1b6d1defec874fdff8b4dc084a5995a9e77a095561764d8cfa8f6d6266"}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.039165][T27638] binder: 27637:27638 ioctl 401c5820 20000000 returned -22 [ 1789.063302][T27645] binder: 27644:27645 ioctl 40086602 20000000 returned -22 [ 1789.075043][T27652] binder: 27650:27652 ioctl 401c5820 20000000 returned -22 [ 1789.083591][T27654] binder: 27653:27654 ioctl 40086602 20000000 returned -22 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x68000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000000c0)='%pB \x00'}, 0x20) (async) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="b1cb73d9b4493cde6c29476170b02e903fe6dd2df8a77c681c858c951998c9c5e05e82f1bb386fff77d7d527b9da10d69effd013463a0f251db11e7385260cbef2c0ec5634d8708ccbcc002cdb6d2003ab57e5ac384fe6341e2abbcea5972f8174a6c5545a2c84a6149838454f7be4444512076ce7593bdc0e04bfbdb6f26ef5062b8c07f2ea90d77edb33dc02ba80be0e5b506f019231a76d938a6cdc1a09c1", 0xa0, 0xfffffffffffffffb) (async) r3 = add_key$user(&(0x7f0000000080), 0x0, &(0x7f0000000100)="9332b53640dfd200c99a40d382885199f9f2f4518894f72c2e8c", 0x1a, 0xfffffffffffffffa) (async) r4 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$dh_compute(0x17, &(0x7f0000000300)={r3, 0x0, r4}, &(0x7f0000000340)=""/105, 0x69, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000340)={0x0, r2, r4}, &(0x7f0000000380)=""/54, 0x36, &(0x7f0000000400)={&(0x7f00000003c0)={'sha3-512-generic\x00'}}) (async) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x121000, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x7, '\x00', 0x0, r5, 0x0, 0x4, 0x2}, 0x48) (async) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x20002, 0x0) (async) r7 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x1) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000017c0)={0xc4, 0x0, &(0x7f00000006c0)=[@decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000540)={@fda={0x66646185, 0x9, 0x0, 0x32}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/191, 0xbf, 0x1, 0x20}}, &(0x7f00000005c0)={0x0, 0x20, 0x38}}}, @free_buffer={0x40086303, r7}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000600)={@fd, @flat=@handle={0x73682a85, 0x100a, 0x1}, @flat=@binder={0x73622a85, 0x10a, 0x1}}, &(0x7f0000000680)={0x0, 0x18, 0x30}}, 0x40}, @increfs={0x40046304, 0x2}, @register_looper, @acquire_done], 0x1000, 0x0, &(0x7f00000007c0)="a47d8e1a09270e43f46f7eb5fa4414c1fa5e1cd82a1ee2c51761ef06fbd3ef65cc106755f72d9dcb44e4158bb8d0f19a2f363e13fcf0d166be46cd1af35f4f24c40393c9e91325bf842874818bfc4df6f79431fe2262684b8f27e61632d976a519a956821bf727b04076fe73455370c9fd20a84298f3e2048f5f9f9f299e9efe69275c09a1e20fa24cdf26ec90183e5055b7778859de305f48115e9837f7731b224c1f24dc080ff5cc4f1d4a0b01e8d0ff737555bebd139975e9e233d443452537144f05f09ceb7fb9b12e96c5f1032fe6e01a5ca9a012198b1ff2d5e836674546f4993e60fbc2a13754f84080984fc8d6adf05d73e40917c585a5ac47669c9c8edfbc24e7c77198f9d2ad6982166006756cd6d38140d206b05678ebff8e9b5f573e5cad89e017743d4bae5fdb1a989123904b585a3d0f38cfaaf1b62d39d9af78cafe3c0505e2fcf3ef5d53970dcfee607300cbd7d7388d28ab83c16b7f8d8d51ffcaefbd9eb6bb586052bde5a5bb79b2cb264ccced28a1fcd5d2f201806939f744128cdb8712672b046bcc621901b3a51fdbfd6308d4646b4ef1deb72ad67e4a18b48b2654c83c56669f6153446e9de7cf4d14014d8cf4150ca4e80069ecc219da6b57f502c7cd2211716a4edd82efd772aff7451b5db33f2d46b184b4048781231e407f01276fc8aaac9182712d7ba7e74f99cab2f89a6fbfb0e1f0f1aedff3b908f6af340aedf286746bd7a4bf19e8bcecf504c159e96fcd845dcb6d771a98a9a720f30a0dfdcafa6936a58b34d60f9a5c7db6fa0b88793e513005e78a4a77cad1b02a5a4391c65c3e5097f108787989d8576f08ec86e2b21bc4cc9fdb746bee8e0af3e61a2cfda7617d067f4188eb6dd8f50e9f63ce1d47664e91d50a878919201d7969b96c8511618ac2f31b996f36580f7caceed0adf81f5f2bb23ec5b738e9c41089c7598ce0d07cdb0420cd137c17d7ed8fa057643c7cd13bcaea87473d51680c29fdcd6b1480ea3b7133e9e3c11c044ad807562cc2b19b09eddcec17347c50d955bea9926519d6cac205593ff8ab771faf6170812642e388f58c50c8c60b2ca2d9a8c5e98c09bce3d8c1ad53680ec7b3c2ce7fd7d5b948af1cc9f72e37c2dc92f040129a9e634a4ecf9d5efbb30650c00624991dbccf516c0dd17acba8d9bd79799b43dc717ed2c855b060f867284594347209176c0885b7348e965735adc01ee0a1e5598f1b9ddb2da550e041c20f4bc5edcb837692610ca2de99c7481b62d62514a119cca7416829662d18d4717b5b89a2891776c78ec49ca393636e725e145ea9e2c00b4bb76cfba09e39b804c09b4917f0040fa13bfc689171cdde6bd476a44af8b8b6fa6277f7439d536e891e5634cafaa33d06826aa4aa2b2ef64df88c5c3f325b988e14b50aa1810cf232e058aeb929f88344d000a0414f72f483d1cce8ecb7d620889528f693742015db0d7a2ecebdd28d750a26d09bda87bfc004ca7a90f19149400826310ca169dd2e08f7f0a37f3fe050e7fe53571e8119f48552e776ec43ca4d52c29a8978611b42a37072130b028d536ec47635a31a005dd7799e22658f8bd7e029764d7753442bb18178ca11b2ddede70b53473dfa8861b51a58c3b7c5edac38ed4078ee3323c6d15ce2ad8ddf6bfcac28f273ddf8e9849cd59f1a69e555c75f80cd141d1c3cc5e16701e58b95dbcf185648700c8dc7c3f7a7b5761498668da8bb3df17ddea6d47a74da7267401e048b37817eccb6748c03880fa04f0c04c8c976863e1a618605caa57b2ded2b7af7bac6f3d058baf5b6436920074609c90020d5216e55cb89cb70606d4050f453f2c360137edbb1727ee73677fb39d15378b07b5aba7f9ca4c40adcd1d1bcb342e449f5021e24d6e52d085db59935e559b61aaa03ac96162d911435b357f71385aed6474feb513f6d47e47d1837fc980c4937478624890c28c8119a471ef93b49d386fdf36d7bae1520bea2c18a64b016283bb7a8b243f100d822bc3ef2e073943f1845bebb43970ce13f4bf82589ff5d3ec502d8536b45202e19d048a831d5eedb7e930f636c53c9fce4c208e63e1bb179ab46fb99514e4fd70ebc9481f98b2bc79a4a9ad6b8c6fa08ab9f887b8b34e7606db59eaf97a128efe78c2a98b8c6d4938c651a19a288d3e41a284e5dedf9773264b567920910beb6528c80100c56ab05fc8866933b33375e4214ab66f807eeb569bba3b0d2493b90d41b00729f77d7d5e3552685e875ea9d50671c042c5541569a5497842a1608c686b616df92b92a2ab7baeb531f8a9aff5dfc216a2e179b1bd6cddbc30b671a7ac1134cd6098a0d167007e361ab49cc2d928b2b38af427b51fab80a95d759dd1d18ae4541ca4400fd268f0ec7335ce6862b09322a35aac1e602b3cf361d5ed9b052b25e04281653cc023c377c6d6ca2f8a8b8f3ad37bdaccf05f5e086b7b17e7b7d5c8c1a991c089984fe8d3994d9b005f167804b46e73763b4dbc3880adc8ccc658d4d165bf630948860287ba78026c5c487a7937e0d8d331359793735de4db54b1b0edaf3c8c88f88ad25731fd1d3b65d080295a872e354c0397ae472e208b1d21c8713a6160c7aedea39706746d53e19e4bc4f7fa33fa04c699340e76f7bb442cc94092fa74dfb1d8e24ef3e1fcd4b2fa6be5de95cb94affd828401fa8560b5fcb3c725e81095f7be94bb6757ee502b0390f85a75d02be92cac263fd500dd709635de8ebf227c547fcd62e6bbc87e57bce487b2624fb1ba72a3ba4de61eefabbde61293dbb58972e519e20758aa6be2e6ae95a9c34608a148860c0899634b393efd6ece8819133ccf9625c34ccd23d1d3fe7f0cbaf4444502db0d12b94b2d2c12f5961bfdb2650a97396061f17becc175db3d716b934f69661b394c0c8af3f960c30d9696ce90cc723bde68affdb327754024cf6a44274d5844676c26ea9e272f289fc20d43a7e9e5b1032aa6cebb3515b9812478e76792f8b9ad1128f35bdcb437c75165336cb06668235c9bb5495dd91298202a6d9b2b184202e00fcd520d7b0b7cab39461b5d3666b6474560698200b3135794d37731a1f991dffb00fba1eb0acaefc7f32e513b950abd8e8ed5e3e25688a3d2d49c219de80014573830d9c92addb34514eb2d6937e5a2f79604bf6dd498f41d8d72f640a15aa87900468d17a41f3e5aa4bd192f8e90c0a55c3c73fbe28862e63d28becd78e3ab612eaeaeb6380b235ccad6bd35ef5e42e111bdddcf35a8f0c80c1280379a9b365f9c7107e7562dcee69853732cede210063c057f889ba6796163cee02a8a97497097b588e036f9c69ff3dc77263beda4f72749b49f33ecfe35838ef5961e41a0f373850419f72f3097822ffd9570741513855fa4472d7fb83a4874a257f9db8141770a0b1eb6c1c4acb36625fd6f84000d4b33328da46603c97e822ef4d4bde477c08d9b5a71ed74b85c7245e54900064d5ef289edb002b513b207f4ea7fa381a549d302ad32f97318b2867503ecebf2013bfb2b35aef9637ee9b4e8bffd49d038584c016334fa8114b385219b0c18a286d92b4a1e000e950e768de9c545be75d172dcd2a9da6147956291a88c306faf73df766b834dfa7d630e755960f03d3451c0bd7bc3d1c974a6517f07aa1991f3e0cb8f67b68d0fe104ff49abf938f67b835175347cf75a2e8274909e86505de416946989776f43a4bae448df42335e96f024435caa254fdaa09a8e162ef680331cd044faef47788ac3e6eb9618debc80a0178eb07744b40686cb04e6de36628b8ef49e7f4b33863c08d400ce6a64dbaafaab62526b2d666347715877dff80f64a322f5a344dba6566c2fff6aff825a2909a92ba6c1b50177e880726e5d1dcc3f36eea7ac15355323e0b3dd9ec716ccebcf63396636b24a22b98a36fb4f76349f40a1ea4cb4768c9f548be5272b3cec13a3727b1654e8efd6883cc7c97ecff34d04a756bf39327e442c31842f908c44b6e7a4a93f8660f14f825e3bde9156a324ca66702b405cd5e7022947cfb8f4b21b042748971bc5cb6a95c208692a9a099bd7cfc57127055a406bbb336e0769fbbf02c5432fc18282906f91a17ece90863fb8bdf20292431607d6c32ab5a0ca3cefdf9dd82c510d065f23275a1873fafec2bca587174c2dce256a45bb2f61758fe313347d8eb644fa162fe54b270a4819d2d2345ff196481babe6c666ee861198f2d828270f9a641c4de88c2d84eb73977dbe594d72d4316d3bb06d22da6838af0da630e9b652e70a0fd746d9cb0e5b16da26f2a5c71a9cb613914bb92bcffd5aac6fde4d34ce91fb44ebd6d1ca703b432962a5fc68c6679e03989021b2391251a886d7a9f3e222a586f6a2a6980c7c8e55f2d2cfeeee7fd470294736ebcbdb36eb8d1667e3603aedfa9a875ae2cbc19748f43f7166a71a5ad9d123abddbee91fdb0ea4a27f4b884cffb30d63bf9e67196f8e8920d66dcc0ff5aee4eb127efbd4d7f07629b5e46bc7cc5955dac4df42be1dab5ef59eb960fe1b5e6cc353516a66821431ea040ea65c50aa0ad4318fbf5996777ccdf4edf9e9b50a68b48d6a58ef19f715910a16d622cc4674ec85e51654a5d31d23165702fee024d4123663a7f437854d19c4c79847e3f6c5440100dab42df234b034f9d91312d3d815443fe9f60175995510e480fffd84e9b38923df51fddf5571821064f85774eb41d14cca545cc29e4cbe1dc7df86840b0e8ecff55188872e73cf394546963ac4417daed9684dc92c48f69128a28dfa60328662007a778d77531c69fcca42867fbe761fa7d53abb6f45d64f96e0e306a8ed2aadb22614726563dba1b9dc6921372cf44bd32df10437c8a7376f0b8243dab37c691220af3e60916a12ba42c9e5912583b9916dc244f3f6115474cb83dd66d5fded5af63e41e9a3110968f6c81bdd68dbab7b6e6c5bcaac8f87709a5956abe7832de08897c7e918234d3cde099f712a8d4021f63443bb4974136d6212078efc9631526ab0ed1c5455e285bda239b1f4b57680bdd7527fc36679f3ff42f81f0f2f9c49bcc835c58aeb59002ce6b3ebd849aabcc23a25f6650bf62ca2d0e392603d44e44812b6100120ff8af39fe3b6d576b76f02f7c970e4d6a643452ddd149f5fc8b5a39f307ef35383474c43d9a39c0273bcbcda55caac21ae6541b619584a3ea152d137e0b7d80c4ded9a7983385b264cff5abcec2c59560e5730c31bd7cf3970ca3910c3d426a7271bdf24d98ac68f579ffdbdb5a65401a4f0a4dd513083e14540da51f1b66aad2bbf4e9ca7893484d70d3604e2e458eea95658a9c57f8d0742b4dafce58c910a4b8766393e31be567f02c8890df1aefc9f1509275f6a35f9d00e3fa193494a02e50188b08edad24df097d48ee2d710530c3ee657bd0de37474d02735441064a16063a8f9bbbcac79787b63b3edd6cfa1b18bdc735b9071cd600f62a557590ccc1ee51cd7a505d8d3d5392bcd5fcfe4d8c9377efa5537c7e6417b8d053c79b5debfc9561905f258cf49ceb71928858fe7d48334c13d9d3cbfd1d5ba9c3fc75ccc9696ccb6916b29970905bfa3c62d75e5c42d642e8481b71b2b9e77e1eb6feb929b44ed7b876d456e02d907f24d0ccab7cfd9a9d9951c01289fc2178b2518b2be0e7f433b5d1fb693991a8b95c1379cba341c92553594a3d2470d11a86a56cffa9875bf89e0e273c8ea60a5df34ae23c8795719ba13f1be2778afa206f9af5bc1b6d1defec874fdff8b4dc084a5995a9e77a095561764d8cfa8f6d6266"}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x2500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x4040637a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x10, r0, 0x8000000) [ 1789.098047][T27659] binder: 27658:27659 ioctl 401c5820 20000000 returned -22 [ 1789.118688][T27665] binder: 27663:27665 ioctl 40086602 20000000 returned -22 [ 1789.132787][T27668] binder: 27667:27668 ioctl 401c5820 20000000 returned -22 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6c000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000000c0)='%pB \x00'}, 0x20) r2 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="b1cb73d9b4493cde6c29476170b02e903fe6dd2df8a77c681c858c951998c9c5e05e82f1bb386fff77d7d527b9da10d69effd013463a0f251db11e7385260cbef2c0ec5634d8708ccbcc002cdb6d2003ab57e5ac384fe6341e2abbcea5972f8174a6c5545a2c84a6149838454f7be4444512076ce7593bdc0e04bfbdb6f26ef5062b8c07f2ea90d77edb33dc02ba80be0e5b506f019231a76d938a6cdc1a09c1", 0xa0, 0xfffffffffffffffb) r3 = add_key$user(&(0x7f0000000080), 0x0, &(0x7f0000000100)="9332b53640dfd200c99a40d382885199f9f2f4518894f72c2e8c", 0x1a, 0xfffffffffffffffa) r4 = add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$dh_compute(0x17, &(0x7f0000000300)={r3, 0x0, r4}, &(0x7f0000000340)=""/105, 0x69, 0x0) (async) keyctl$dh_compute(0x17, &(0x7f0000000300)={r3, 0x0, r4}, &(0x7f0000000340)=""/105, 0x69, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000340)={0x0, r2, r4}, &(0x7f0000000380)=""/54, 0x36, &(0x7f0000000400)={&(0x7f00000003c0)={'sha3-512-generic\x00'}}) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140), 0x121000, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x7, '\x00', 0x0, r5, 0x0, 0x4, 0x2}, 0x48) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x20002, 0x0) (async) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000440), 0x20002, 0x0) r7 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x1) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000017c0)={0xc4, 0x0, &(0x7f00000006c0)=[@decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000540)={@fda={0x66646185, 0x9, 0x0, 0x32}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/191, 0xbf, 0x1, 0x20}}, &(0x7f00000005c0)={0x0, 0x20, 0x38}}}, @free_buffer={0x40086303, r7}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000600)={@fd, @flat=@handle={0x73682a85, 0x100a, 0x1}, @flat=@binder={0x73622a85, 0x10a, 0x1}}, &(0x7f0000000680)={0x0, 0x18, 0x30}}, 0x40}, @increfs={0x40046304, 0x2}, @register_looper, @acquire_done], 0x1000, 0x0, &(0x7f00000007c0)="a47d8e1a09270e43f46f7eb5fa4414c1fa5e1cd82a1ee2c51761ef06fbd3ef65cc106755f72d9dcb44e4158bb8d0f19a2f363e13fcf0d166be46cd1af35f4f24c40393c9e91325bf842874818bfc4df6f79431fe2262684b8f27e61632d976a519a956821bf727b04076fe73455370c9fd20a84298f3e2048f5f9f9f299e9efe69275c09a1e20fa24cdf26ec90183e5055b7778859de305f48115e9837f7731b224c1f24dc080ff5cc4f1d4a0b01e8d0ff737555bebd139975e9e233d443452537144f05f09ceb7fb9b12e96c5f1032fe6e01a5ca9a012198b1ff2d5e836674546f4993e60fbc2a13754f84080984fc8d6adf05d73e40917c585a5ac47669c9c8edfbc24e7c77198f9d2ad6982166006756cd6d38140d206b05678ebff8e9b5f573e5cad89e017743d4bae5fdb1a989123904b585a3d0f38cfaaf1b62d39d9af78cafe3c0505e2fcf3ef5d53970dcfee607300cbd7d7388d28ab83c16b7f8d8d51ffcaefbd9eb6bb586052bde5a5bb79b2cb264ccced28a1fcd5d2f201806939f744128cdb8712672b046bcc621901b3a51fdbfd6308d4646b4ef1deb72ad67e4a18b48b2654c83c56669f6153446e9de7cf4d14014d8cf4150ca4e80069ecc219da6b57f502c7cd2211716a4edd82efd772aff7451b5db33f2d46b184b4048781231e407f01276fc8aaac9182712d7ba7e74f99cab2f89a6fbfb0e1f0f1aedff3b908f6af340aedf286746bd7a4bf19e8bcecf504c159e96fcd845dcb6d771a98a9a720f30a0dfdcafa6936a58b34d60f9a5c7db6fa0b88793e513005e78a4a77cad1b02a5a4391c65c3e5097f108787989d8576f08ec86e2b21bc4cc9fdb746bee8e0af3e61a2cfda7617d067f4188eb6dd8f50e9f63ce1d47664e91d50a878919201d7969b96c8511618ac2f31b996f36580f7caceed0adf81f5f2bb23ec5b738e9c41089c7598ce0d07cdb0420cd137c17d7ed8fa057643c7cd13bcaea87473d51680c29fdcd6b1480ea3b7133e9e3c11c044ad807562cc2b19b09eddcec17347c50d955bea9926519d6cac205593ff8ab771faf6170812642e388f58c50c8c60b2ca2d9a8c5e98c09bce3d8c1ad53680ec7b3c2ce7fd7d5b948af1cc9f72e37c2dc92f040129a9e634a4ecf9d5efbb30650c00624991dbccf516c0dd17acba8d9bd79799b43dc717ed2c855b060f867284594347209176c0885b7348e965735adc01ee0a1e5598f1b9ddb2da550e041c20f4bc5edcb837692610ca2de99c7481b62d62514a119cca7416829662d18d4717b5b89a2891776c78ec49ca393636e725e145ea9e2c00b4bb76cfba09e39b804c09b4917f0040fa13bfc689171cdde6bd476a44af8b8b6fa6277f7439d536e891e5634cafaa33d06826aa4aa2b2ef64df88c5c3f325b988e14b50aa1810cf232e058aeb929f88344d000a0414f72f483d1cce8ecb7d620889528f693742015db0d7a2ecebdd28d750a26d09bda87bfc004ca7a90f19149400826310ca169dd2e08f7f0a37f3fe050e7fe53571e8119f48552e776ec43ca4d52c29a8978611b42a37072130b028d536ec47635a31a005dd7799e22658f8bd7e029764d7753442bb18178ca11b2ddede70b53473dfa8861b51a58c3b7c5edac38ed4078ee3323c6d15ce2ad8ddf6bfcac28f273ddf8e9849cd59f1a69e555c75f80cd141d1c3cc5e16701e58b95dbcf185648700c8dc7c3f7a7b5761498668da8bb3df17ddea6d47a74da7267401e048b37817eccb6748c03880fa04f0c04c8c976863e1a618605caa57b2ded2b7af7bac6f3d058baf5b6436920074609c90020d5216e55cb89cb70606d4050f453f2c360137edbb1727ee73677fb39d15378b07b5aba7f9ca4c40adcd1d1bcb342e449f5021e24d6e52d085db59935e559b61aaa03ac96162d911435b357f71385aed6474feb513f6d47e47d1837fc980c4937478624890c28c8119a471ef93b49d386fdf36d7bae1520bea2c18a64b016283bb7a8b243f100d822bc3ef2e073943f1845bebb43970ce13f4bf82589ff5d3ec502d8536b45202e19d048a831d5eedb7e930f636c53c9fce4c208e63e1bb179ab46fb99514e4fd70ebc9481f98b2bc79a4a9ad6b8c6fa08ab9f887b8b34e7606db59eaf97a128efe78c2a98b8c6d4938c651a19a288d3e41a284e5dedf9773264b567920910beb6528c80100c56ab05fc8866933b33375e4214ab66f807eeb569bba3b0d2493b90d41b00729f77d7d5e3552685e875ea9d50671c042c5541569a5497842a1608c686b616df92b92a2ab7baeb531f8a9aff5dfc216a2e179b1bd6cddbc30b671a7ac1134cd6098a0d167007e361ab49cc2d928b2b38af427b51fab80a95d759dd1d18ae4541ca4400fd268f0ec7335ce6862b09322a35aac1e602b3cf361d5ed9b052b25e04281653cc023c377c6d6ca2f8a8b8f3ad37bdaccf05f5e086b7b17e7b7d5c8c1a991c089984fe8d3994d9b005f167804b46e73763b4dbc3880adc8ccc658d4d165bf630948860287ba78026c5c487a7937e0d8d331359793735de4db54b1b0edaf3c8c88f88ad25731fd1d3b65d080295a872e354c0397ae472e208b1d21c8713a6160c7aedea39706746d53e19e4bc4f7fa33fa04c699340e76f7bb442cc94092fa74dfb1d8e24ef3e1fcd4b2fa6be5de95cb94affd828401fa8560b5fcb3c725e81095f7be94bb6757ee502b0390f85a75d02be92cac263fd500dd709635de8ebf227c547fcd62e6bbc87e57bce487b2624fb1ba72a3ba4de61eefabbde61293dbb58972e519e20758aa6be2e6ae95a9c34608a148860c0899634b393efd6ece8819133ccf9625c34ccd23d1d3fe7f0cbaf4444502db0d12b94b2d2c12f5961bfdb2650a97396061f17becc175db3d716b934f69661b394c0c8af3f960c30d9696ce90cc723bde68affdb327754024cf6a44274d5844676c26ea9e272f289fc20d43a7e9e5b1032aa6cebb3515b9812478e76792f8b9ad1128f35bdcb437c75165336cb06668235c9bb5495dd91298202a6d9b2b184202e00fcd520d7b0b7cab39461b5d3666b6474560698200b3135794d37731a1f991dffb00fba1eb0acaefc7f32e513b950abd8e8ed5e3e25688a3d2d49c219de80014573830d9c92addb34514eb2d6937e5a2f79604bf6dd498f41d8d72f640a15aa87900468d17a41f3e5aa4bd192f8e90c0a55c3c73fbe28862e63d28becd78e3ab612eaeaeb6380b235ccad6bd35ef5e42e111bdddcf35a8f0c80c1280379a9b365f9c7107e7562dcee69853732cede210063c057f889ba6796163cee02a8a97497097b588e036f9c69ff3dc77263beda4f72749b49f33ecfe35838ef5961e41a0f373850419f72f3097822ffd9570741513855fa4472d7fb83a4874a257f9db8141770a0b1eb6c1c4acb36625fd6f84000d4b33328da46603c97e822ef4d4bde477c08d9b5a71ed74b85c7245e54900064d5ef289edb002b513b207f4ea7fa381a549d302ad32f97318b2867503ecebf2013bfb2b35aef9637ee9b4e8bffd49d038584c016334fa8114b385219b0c18a286d92b4a1e000e950e768de9c545be75d172dcd2a9da6147956291a88c306faf73df766b834dfa7d630e755960f03d3451c0bd7bc3d1c974a6517f07aa1991f3e0cb8f67b68d0fe104ff49abf938f67b835175347cf75a2e8274909e86505de416946989776f43a4bae448df42335e96f024435caa254fdaa09a8e162ef680331cd044faef47788ac3e6eb9618debc80a0178eb07744b40686cb04e6de36628b8ef49e7f4b33863c08d400ce6a64dbaafaab62526b2d666347715877dff80f64a322f5a344dba6566c2fff6aff825a2909a92ba6c1b50177e880726e5d1dcc3f36eea7ac15355323e0b3dd9ec716ccebcf63396636b24a22b98a36fb4f76349f40a1ea4cb4768c9f548be5272b3cec13a3727b1654e8efd6883cc7c97ecff34d04a756bf39327e442c31842f908c44b6e7a4a93f8660f14f825e3bde9156a324ca66702b405cd5e7022947cfb8f4b21b042748971bc5cb6a95c208692a9a099bd7cfc57127055a406bbb336e0769fbbf02c5432fc18282906f91a17ece90863fb8bdf20292431607d6c32ab5a0ca3cefdf9dd82c510d065f23275a1873fafec2bca587174c2dce256a45bb2f61758fe313347d8eb644fa162fe54b270a4819d2d2345ff196481babe6c666ee861198f2d828270f9a641c4de88c2d84eb73977dbe594d72d4316d3bb06d22da6838af0da630e9b652e70a0fd746d9cb0e5b16da26f2a5c71a9cb613914bb92bcffd5aac6fde4d34ce91fb44ebd6d1ca703b432962a5fc68c6679e03989021b2391251a886d7a9f3e222a586f6a2a6980c7c8e55f2d2cfeeee7fd470294736ebcbdb36eb8d1667e3603aedfa9a875ae2cbc19748f43f7166a71a5ad9d123abddbee91fdb0ea4a27f4b884cffb30d63bf9e67196f8e8920d66dcc0ff5aee4eb127efbd4d7f07629b5e46bc7cc5955dac4df42be1dab5ef59eb960fe1b5e6cc353516a66821431ea040ea65c50aa0ad4318fbf5996777ccdf4edf9e9b50a68b48d6a58ef19f715910a16d622cc4674ec85e51654a5d31d23165702fee024d4123663a7f437854d19c4c79847e3f6c5440100dab42df234b034f9d91312d3d815443fe9f60175995510e480fffd84e9b38923df51fddf5571821064f85774eb41d14cca545cc29e4cbe1dc7df86840b0e8ecff55188872e73cf394546963ac4417daed9684dc92c48f69128a28dfa60328662007a778d77531c69fcca42867fbe761fa7d53abb6f45d64f96e0e306a8ed2aadb22614726563dba1b9dc6921372cf44bd32df10437c8a7376f0b8243dab37c691220af3e60916a12ba42c9e5912583b9916dc244f3f6115474cb83dd66d5fded5af63e41e9a3110968f6c81bdd68dbab7b6e6c5bcaac8f87709a5956abe7832de08897c7e918234d3cde099f712a8d4021f63443bb4974136d6212078efc9631526ab0ed1c5455e285bda239b1f4b57680bdd7527fc36679f3ff42f81f0f2f9c49bcc835c58aeb59002ce6b3ebd849aabcc23a25f6650bf62ca2d0e392603d44e44812b6100120ff8af39fe3b6d576b76f02f7c970e4d6a643452ddd149f5fc8b5a39f307ef35383474c43d9a39c0273bcbcda55caac21ae6541b619584a3ea152d137e0b7d80c4ded9a7983385b264cff5abcec2c59560e5730c31bd7cf3970ca3910c3d426a7271bdf24d98ac68f579ffdbdb5a65401a4f0a4dd513083e14540da51f1b66aad2bbf4e9ca7893484d70d3604e2e458eea95658a9c57f8d0742b4dafce58c910a4b8766393e31be567f02c8890df1aefc9f1509275f6a35f9d00e3fa193494a02e50188b08edad24df097d48ee2d710530c3ee657bd0de37474d02735441064a16063a8f9bbbcac79787b63b3edd6cfa1b18bdc735b9071cd600f62a557590ccc1ee51cd7a505d8d3d5392bcd5fcfe4d8c9377efa5537c7e6417b8d053c79b5debfc9561905f258cf49ceb71928858fe7d48334c13d9d3cbfd1d5ba9c3fc75ccc9696ccb6916b29970905bfa3c62d75e5c42d642e8481b71b2b9e77e1eb6feb929b44ed7b876d456e02d907f24d0ccab7cfd9a9d9951c01289fc2178b2518b2be0e7f433b5d1fb693991a8b95c1379cba341c92553594a3d2470d11a86a56cffa9875bf89e0e273c8ea60a5df34ae23c8795719ba13f1be2778afa206f9af5bc1b6d1defec874fdff8b4dc084a5995a9e77a095561764d8cfa8f6d6266"}) (async) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000017c0)={0xc4, 0x0, &(0x7f00000006c0)=[@decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000540)={@fda={0x66646185, 0x9, 0x0, 0x32}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/191, 0xbf, 0x1, 0x20}}, &(0x7f00000005c0)={0x0, 0x20, 0x38}}}, @free_buffer={0x40086303, r7}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000600)={@fd, @flat=@handle={0x73682a85, 0x100a, 0x1}, @flat=@binder={0x73622a85, 0x10a, 0x1}}, &(0x7f0000000680)={0x0, 0x18, 0x30}}, 0x40}, @increfs={0x40046304, 0x2}, @register_looper, @acquire_done], 0x1000, 0x0, &(0x7f00000007c0)="a47d8e1a09270e43f46f7eb5fa4414c1fa5e1cd82a1ee2c51761ef06fbd3ef65cc106755f72d9dcb44e4158bb8d0f19a2f363e13fcf0d166be46cd1af35f4f24c40393c9e91325bf842874818bfc4df6f79431fe2262684b8f27e61632d976a519a956821bf727b04076fe73455370c9fd20a84298f3e2048f5f9f9f299e9efe69275c09a1e20fa24cdf26ec90183e5055b7778859de305f48115e9837f7731b224c1f24dc080ff5cc4f1d4a0b01e8d0ff737555bebd139975e9e233d443452537144f05f09ceb7fb9b12e96c5f1032fe6e01a5ca9a012198b1ff2d5e836674546f4993e60fbc2a13754f84080984fc8d6adf05d73e40917c585a5ac47669c9c8edfbc24e7c77198f9d2ad6982166006756cd6d38140d206b05678ebff8e9b5f573e5cad89e017743d4bae5fdb1a989123904b585a3d0f38cfaaf1b62d39d9af78cafe3c0505e2fcf3ef5d53970dcfee607300cbd7d7388d28ab83c16b7f8d8d51ffcaefbd9eb6bb586052bde5a5bb79b2cb264ccced28a1fcd5d2f201806939f744128cdb8712672b046bcc621901b3a51fdbfd6308d4646b4ef1deb72ad67e4a18b48b2654c83c56669f6153446e9de7cf4d14014d8cf4150ca4e80069ecc219da6b57f502c7cd2211716a4edd82efd772aff7451b5db33f2d46b184b4048781231e407f01276fc8aaac9182712d7ba7e74f99cab2f89a6fbfb0e1f0f1aedff3b908f6af340aedf286746bd7a4bf19e8bcecf504c159e96fcd845dcb6d771a98a9a720f30a0dfdcafa6936a58b34d60f9a5c7db6fa0b88793e513005e78a4a77cad1b02a5a4391c65c3e5097f108787989d8576f08ec86e2b21bc4cc9fdb746bee8e0af3e61a2cfda7617d067f4188eb6dd8f50e9f63ce1d47664e91d50a878919201d7969b96c8511618ac2f31b996f36580f7caceed0adf81f5f2bb23ec5b738e9c41089c7598ce0d07cdb0420cd137c17d7ed8fa057643c7cd13bcaea87473d51680c29fdcd6b1480ea3b7133e9e3c11c044ad807562cc2b19b09eddcec17347c50d955bea9926519d6cac205593ff8ab771faf6170812642e388f58c50c8c60b2ca2d9a8c5e98c09bce3d8c1ad53680ec7b3c2ce7fd7d5b948af1cc9f72e37c2dc92f040129a9e634a4ecf9d5efbb30650c00624991dbccf516c0dd17acba8d9bd79799b43dc717ed2c855b060f867284594347209176c0885b7348e965735adc01ee0a1e5598f1b9ddb2da550e041c20f4bc5edcb837692610ca2de99c7481b62d62514a119cca7416829662d18d4717b5b89a2891776c78ec49ca393636e725e145ea9e2c00b4bb76cfba09e39b804c09b4917f0040fa13bfc689171cdde6bd476a44af8b8b6fa6277f7439d536e891e5634cafaa33d06826aa4aa2b2ef64df88c5c3f325b988e14b50aa1810cf232e058aeb929f88344d000a0414f72f483d1cce8ecb7d620889528f693742015db0d7a2ecebdd28d750a26d09bda87bfc004ca7a90f19149400826310ca169dd2e08f7f0a37f3fe050e7fe53571e8119f48552e776ec43ca4d52c29a8978611b42a37072130b028d536ec47635a31a005dd7799e22658f8bd7e029764d7753442bb18178ca11b2ddede70b53473dfa8861b51a58c3b7c5edac38ed4078ee3323c6d15ce2ad8ddf6bfcac28f273ddf8e9849cd59f1a69e555c75f80cd141d1c3cc5e16701e58b95dbcf185648700c8dc7c3f7a7b5761498668da8bb3df17ddea6d47a74da7267401e048b37817eccb6748c03880fa04f0c04c8c976863e1a618605caa57b2ded2b7af7bac6f3d058baf5b6436920074609c90020d5216e55cb89cb70606d4050f453f2c360137edbb1727ee73677fb39d15378b07b5aba7f9ca4c40adcd1d1bcb342e449f5021e24d6e52d085db59935e559b61aaa03ac96162d911435b357f71385aed6474feb513f6d47e47d1837fc980c4937478624890c28c8119a471ef93b49d386fdf36d7bae1520bea2c18a64b016283bb7a8b243f100d822bc3ef2e073943f1845bebb43970ce13f4bf82589ff5d3ec502d8536b45202e19d048a831d5eedb7e930f636c53c9fce4c208e63e1bb179ab46fb99514e4fd70ebc9481f98b2bc79a4a9ad6b8c6fa08ab9f887b8b34e7606db59eaf97a128efe78c2a98b8c6d4938c651a19a288d3e41a284e5dedf9773264b567920910beb6528c80100c56ab05fc8866933b33375e4214ab66f807eeb569bba3b0d2493b90d41b00729f77d7d5e3552685e875ea9d50671c042c5541569a5497842a1608c686b616df92b92a2ab7baeb531f8a9aff5dfc216a2e179b1bd6cddbc30b671a7ac1134cd6098a0d167007e361ab49cc2d928b2b38af427b51fab80a95d759dd1d18ae4541ca4400fd268f0ec7335ce6862b09322a35aac1e602b3cf361d5ed9b052b25e04281653cc023c377c6d6ca2f8a8b8f3ad37bdaccf05f5e086b7b17e7b7d5c8c1a991c089984fe8d3994d9b005f167804b46e73763b4dbc3880adc8ccc658d4d165bf630948860287ba78026c5c487a7937e0d8d331359793735de4db54b1b0edaf3c8c88f88ad25731fd1d3b65d080295a872e354c0397ae472e208b1d21c8713a6160c7aedea39706746d53e19e4bc4f7fa33fa04c699340e76f7bb442cc94092fa74dfb1d8e24ef3e1fcd4b2fa6be5de95cb94affd828401fa8560b5fcb3c725e81095f7be94bb6757ee502b0390f85a75d02be92cac263fd500dd709635de8ebf227c547fcd62e6bbc87e57bce487b2624fb1ba72a3ba4de61eefabbde61293dbb58972e519e20758aa6be2e6ae95a9c34608a148860c0899634b393efd6ece8819133ccf9625c34ccd23d1d3fe7f0cbaf4444502db0d12b94b2d2c12f5961bfdb2650a97396061f17becc175db3d716b934f69661b394c0c8af3f960c30d9696ce90cc723bde68affdb327754024cf6a44274d5844676c26ea9e272f289fc20d43a7e9e5b1032aa6cebb3515b9812478e76792f8b9ad1128f35bdcb437c75165336cb06668235c9bb5495dd91298202a6d9b2b184202e00fcd520d7b0b7cab39461b5d3666b6474560698200b3135794d37731a1f991dffb00fba1eb0acaefc7f32e513b950abd8e8ed5e3e25688a3d2d49c219de80014573830d9c92addb34514eb2d6937e5a2f79604bf6dd498f41d8d72f640a15aa87900468d17a41f3e5aa4bd192f8e90c0a55c3c73fbe28862e63d28becd78e3ab612eaeaeb6380b235ccad6bd35ef5e42e111bdddcf35a8f0c80c1280379a9b365f9c7107e7562dcee69853732cede210063c057f889ba6796163cee02a8a97497097b588e036f9c69ff3dc77263beda4f72749b49f33ecfe35838ef5961e41a0f373850419f72f3097822ffd9570741513855fa4472d7fb83a4874a257f9db8141770a0b1eb6c1c4acb36625fd6f84000d4b33328da46603c97e822ef4d4bde477c08d9b5a71ed74b85c7245e54900064d5ef289edb002b513b207f4ea7fa381a549d302ad32f97318b2867503ecebf2013bfb2b35aef9637ee9b4e8bffd49d038584c016334fa8114b385219b0c18a286d92b4a1e000e950e768de9c545be75d172dcd2a9da6147956291a88c306faf73df766b834dfa7d630e755960f03d3451c0bd7bc3d1c974a6517f07aa1991f3e0cb8f67b68d0fe104ff49abf938f67b835175347cf75a2e8274909e86505de416946989776f43a4bae448df42335e96f024435caa254fdaa09a8e162ef680331cd044faef47788ac3e6eb9618debc80a0178eb07744b40686cb04e6de36628b8ef49e7f4b33863c08d400ce6a64dbaafaab62526b2d666347715877dff80f64a322f5a344dba6566c2fff6aff825a2909a92ba6c1b50177e880726e5d1dcc3f36eea7ac15355323e0b3dd9ec716ccebcf63396636b24a22b98a36fb4f76349f40a1ea4cb4768c9f548be5272b3cec13a3727b1654e8efd6883cc7c97ecff34d04a756bf39327e442c31842f908c44b6e7a4a93f8660f14f825e3bde9156a324ca66702b405cd5e7022947cfb8f4b21b042748971bc5cb6a95c208692a9a099bd7cfc57127055a406bbb336e0769fbbf02c5432fc18282906f91a17ece90863fb8bdf20292431607d6c32ab5a0ca3cefdf9dd82c510d065f23275a1873fafec2bca587174c2dce256a45bb2f61758fe313347d8eb644fa162fe54b270a4819d2d2345ff196481babe6c666ee861198f2d828270f9a641c4de88c2d84eb73977dbe594d72d4316d3bb06d22da6838af0da630e9b652e70a0fd746d9cb0e5b16da26f2a5c71a9cb613914bb92bcffd5aac6fde4d34ce91fb44ebd6d1ca703b432962a5fc68c6679e03989021b2391251a886d7a9f3e222a586f6a2a6980c7c8e55f2d2cfeeee7fd470294736ebcbdb36eb8d1667e3603aedfa9a875ae2cbc19748f43f7166a71a5ad9d123abddbee91fdb0ea4a27f4b884cffb30d63bf9e67196f8e8920d66dcc0ff5aee4eb127efbd4d7f07629b5e46bc7cc5955dac4df42be1dab5ef59eb960fe1b5e6cc353516a66821431ea040ea65c50aa0ad4318fbf5996777ccdf4edf9e9b50a68b48d6a58ef19f715910a16d622cc4674ec85e51654a5d31d23165702fee024d4123663a7f437854d19c4c79847e3f6c5440100dab42df234b034f9d91312d3d815443fe9f60175995510e480fffd84e9b38923df51fddf5571821064f85774eb41d14cca545cc29e4cbe1dc7df86840b0e8ecff55188872e73cf394546963ac4417daed9684dc92c48f69128a28dfa60328662007a778d77531c69fcca42867fbe761fa7d53abb6f45d64f96e0e306a8ed2aadb22614726563dba1b9dc6921372cf44bd32df10437c8a7376f0b8243dab37c691220af3e60916a12ba42c9e5912583b9916dc244f3f6115474cb83dd66d5fded5af63e41e9a3110968f6c81bdd68dbab7b6e6c5bcaac8f87709a5956abe7832de08897c7e918234d3cde099f712a8d4021f63443bb4974136d6212078efc9631526ab0ed1c5455e285bda239b1f4b57680bdd7527fc36679f3ff42f81f0f2f9c49bcc835c58aeb59002ce6b3ebd849aabcc23a25f6650bf62ca2d0e392603d44e44812b6100120ff8af39fe3b6d576b76f02f7c970e4d6a643452ddd149f5fc8b5a39f307ef35383474c43d9a39c0273bcbcda55caac21ae6541b619584a3ea152d137e0b7d80c4ded9a7983385b264cff5abcec2c59560e5730c31bd7cf3970ca3910c3d426a7271bdf24d98ac68f579ffdbdb5a65401a4f0a4dd513083e14540da51f1b66aad2bbf4e9ca7893484d70d3604e2e458eea95658a9c57f8d0742b4dafce58c910a4b8766393e31be567f02c8890df1aefc9f1509275f6a35f9d00e3fa193494a02e50188b08edad24df097d48ee2d710530c3ee657bd0de37474d02735441064a16063a8f9bbbcac79787b63b3edd6cfa1b18bdc735b9071cd600f62a557590ccc1ee51cd7a505d8d3d5392bcd5fcfe4d8c9377efa5537c7e6417b8d053c79b5debfc9561905f258cf49ceb71928858fe7d48334c13d9d3cbfd1d5ba9c3fc75ccc9696ccb6916b29970905bfa3c62d75e5c42d642e8481b71b2b9e77e1eb6feb929b44ed7b876d456e02d907f24d0ccab7cfd9a9d9951c01289fc2178b2518b2be0e7f433b5d1fb693991a8b95c1379cba341c92553594a3d2470d11a86a56cffa9875bf89e0e273c8ea60a5df34ae23c8795719ba13f1be2778afa206f9af5bc1b6d1defec874fdff8b4dc084a5995a9e77a095561764d8cfa8f6d6266"}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406400, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x10, r0, 0x8000000) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x10, r0, 0x8000000) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.145208][T27676] binder: 27669:27676 ioctl 40086602 20000000 returned -22 [ 1789.159583][T27681] binder: 27671:27681 ioctl 401c5820 20000000 returned -22 [ 1789.167761][T27682] binder: 27679:27682 ioctl 40086602 20000000 returned -22 [ 1789.179071][T27688] binder: 27683:27688 ioctl 40086602 20000000 returned -22 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x74000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = io_uring_setup(0x5ae4, &(0x7f00000000c0)={0x0, 0xe600, 0x10, 0x0, 0x2c0}) io_uring_register$IORING_UNREGISTER_FILES(r1, 0x3, 0x0, 0x0) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, 0xffffffffffffffff, 0x8000000) [ 1789.201169][T27691] binder: 27685:27691 ioctl 401c5820 20000000 returned -22 [ 1789.209250][T27696] binder: 27695:27696 ioctl 401c5820 20000000 returned -22 [ 1789.218371][T27700] binder: 27699:27700 ioctl 40086602 20000000 returned -22 [ 1789.218486][T27701] binder: 27697:27701 ioctl 40086602 20000000 returned -22 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async, rerun: 64) r1 = io_uring_setup(0x5ae4, &(0x7f00000000c0)={0x0, 0xe600, 0x10, 0x0, 0x2c0}) (rerun: 64) io_uring_register$IORING_UNREGISTER_FILES(r1, 0x3, 0x0, 0x0) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7a000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406900, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1789.249848][T27706] binder: 27705:27706 ioctl 401c5820 20000000 returned -22 [ 1789.258661][T27710] binder: 27709:27710 ioctl 401c5820 20000000 returned -22 [ 1789.271387][T27716] binder: 27713:27716 ioctl 40086602 20000000 returned -22 [ 1789.279564][T27717] binder: 27711:27717 ioctl 40086602 20000000 returned -22 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xff600000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1789.299105][T27721] binder: 27719:27721 ioctl 401c5820 20000000 returned -22 [ 1789.309902][T27723] binder: 27722:27723 ioctl 401c5820 20000000 returned -22 [ 1789.321500][T27725] binder: 27724:27725 ioctl 401c5820 20000000 returned -22 [ 1789.327029][T27728] binder: 27726:27728 ioctl 40086602 20000000 returned -22 [ 1789.337105][T27729] binder: 27727:27729 ioctl 40086602 20000000 returned -22 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406f00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x60ffffffffff, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40407000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1789.353336][T27731] binder: 27730:27731 ioctl 401c5820 20000000 returned -22 [ 1789.366395][T27733] binder: 27732:27733 ioctl 401c5820 20000000 returned -22 [ 1789.374654][T27738] binder: 27735:27738 ioctl 40086602 20000000 returned -22 [ 1789.385264][T27739] binder: 27737:27739 ioctl 40086602 20000000 returned -22 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x100000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40407300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.402318][T27743] binder: 27742:27743 ioctl 401c5820 20000000 returned -22 [ 1789.423797][T27745] binder: 27744:27745 ioctl 401c5820 20000000 returned -22 [ 1789.429435][T27748] binder: 27747:27748 ioctl 40086602 20000000 returned -22 [ 1789.432685][T27749] binder: 27746:27749 ioctl 40086602 20000000 returned -22 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40407400, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x200000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.450869][T27751] binder: 27750:27751 ioctl 401c5820 20000000 returned -22 [ 1789.457178][T27753] binder: 27752:27753 ioctl 40086602 20000000 returned -22 [ 1789.474974][T27757] binder: 27756:27757 ioctl 401c5820 20000000 returned -22 [ 1789.484349][T27759] binder: 27758:27759 ioctl 401c5820 20000000 returned -22 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40407500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1789.502905][T27762] binder: 27760:27762 ioctl 40086602 20000000 returned -22 [ 1789.504253][T27765] binder: 27764:27765 ioctl 40086602 20000000 returned -22 [ 1789.528541][T27767] binder: 27766:27767 ioctl 401c5820 20000000 returned -22 [ 1789.543507][T27771] binder: 27770:27771 ioctl 401c5820 20000000 returned -22 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) r1 = io_uring_setup(0x5ae4, &(0x7f00000000c0)={0x0, 0xe600, 0x10, 0x0, 0x2c0}) io_uring_register$IORING_UNREGISTER_FILES(r1, 0x3, 0x0, 0x0) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x300000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40407800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.557526][T27773] binder: 27772:27773 ioctl 40086602 20000000 returned -22 [ 1789.582768][T27778] binder: 27776:27778 ioctl 401c5820 20000000 returned -22 [ 1789.595709][T27779] binder: 27777:27779 ioctl 401c5820 20000000 returned -22 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x40000, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}], [{@obj_role={'obj_role', 0x3d, 'sit0\x00'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@flag='sync'}, {@smackfsdef={'smackfsdef', 0x3d, './binderfs2/binder1\x00'}}, {@subj_role={'subj_role', 0x3d, '&$\\'}}, {@fowner_lt={'fowner<', 0xee01}}, {@obj_type={'obj_type', 0x3d, ',(\x1c#[-\x01(**\x88@@,#'}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@pcr={'pcr', 0x3d, 0x25}}]}}, 0x1, 0x0, &(0x7f00000002c0)="cef5bf9bfccdf0bc91ac164816014acbc71b22d3c33bad0320f80fafb738823eb3163f9bedd229a112d5c028921f7c6d4e62a800dc02f07d6ef9aa3b231b23195ff38ef8ca20adeccfffa07320644dea6b69fbe521eae34970fe9a140837ba8b81ad48e9a507cba74c3ae552264c484d5892ec346e6df4967299f60e24806111ca631d56db7a71e7835a8b017acdfc2027fad4049ea0723c2bb089ee66b3bf978bce8f606dceacf90bde11844e143dd4b00b9e0f05a9fe8dc34a29dc0f7eff6c6c7bd2e476da61e2899c38f07f80c0d1aa754a") getdents(r1, &(0x7f00000003c0)=""/151, 0x97) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x2, 0x0) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x400000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x40000, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}], [{@obj_role={'obj_role', 0x3d, 'sit0\x00'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@flag='sync'}, {@smackfsdef={'smackfsdef', 0x3d, './binderfs2/binder1\x00'}}, {@subj_role={'subj_role', 0x3d, '&$\\'}}, {@fowner_lt={'fowner<', 0xee01}}, {@obj_type={'obj_type', 0x3d, ',(\x1c#[-\x01(**\x88@@,#'}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@pcr={'pcr', 0x3d, 0x25}}]}}, 0x1, 0x0, &(0x7f00000002c0)="cef5bf9bfccdf0bc91ac164816014acbc71b22d3c33bad0320f80fafb738823eb3163f9bedd229a112d5c028921f7c6d4e62a800dc02f07d6ef9aa3b231b23195ff38ef8ca20adeccfffa07320644dea6b69fbe521eae34970fe9a140837ba8b81ad48e9a507cba74c3ae552264c484d5892ec346e6df4967299f60e24806111ca631d56db7a71e7835a8b017acdfc2027fad4049ea0723c2bb089ee66b3bf978bce8f606dceacf90bde11844e143dd4b00b9e0f05a9fe8dc34a29dc0f7eff6c6c7bd2e476da61e2899c38f07f80c0d1aa754a") getdents(r1, &(0x7f00000003c0)=""/151, 0x97) (async) getdents(r1, &(0x7f00000003c0)=""/151, 0x97) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x2, 0x0) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40407a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.595946][T27781] binder: 27780:27781 ioctl 40086602 20000000 returned -22 [ 1789.621966][T27784] binder: 27783:27784 ioctl 40086602 20000000 returned -22 [ 1789.635845][T27791] binder: 27790:27791 ioctl 401c5820 20000000 returned -22 [ 1789.644117][T27793] binder: 27792:27793 ioctl 40086602 20000000 returned -22 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 1: socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x40000, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}], [{@obj_role={'obj_role', 0x3d, 'sit0\x00'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@flag='sync'}, {@smackfsdef={'smackfsdef', 0x3d, './binderfs2/binder1\x00'}}, {@subj_role={'subj_role', 0x3d, '&$\\'}}, {@fowner_lt={'fowner<', 0xee01}}, {@obj_type={'obj_type', 0x3d, ',(\x1c#[-\x01(**\x88@@,#'}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@pcr={'pcr', 0x3d, 0x25}}]}}, 0x1, 0x0, &(0x7f00000002c0)="cef5bf9bfccdf0bc91ac164816014acbc71b22d3c33bad0320f80fafb738823eb3163f9bedd229a112d5c028921f7c6d4e62a800dc02f07d6ef9aa3b231b23195ff38ef8ca20adeccfffa07320644dea6b69fbe521eae34970fe9a140837ba8b81ad48e9a507cba74c3ae552264c484d5892ec346e6df4967299f60e24806111ca631d56db7a71e7835a8b017acdfc2027fad4049ea0723c2bb089ee66b3bf978bce8f606dceacf90bde11844e143dd4b00b9e0f05a9fe8dc34a29dc0f7eff6c6c7bd2e476da61e2899c38f07f80c0d1aa754a") getdents(r1, &(0x7f00000003c0)=""/151, 0x97) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x2, 0x0) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x500000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.660145][T27801] binder: 27798:27801 ioctl 401c5820 20000000 returned -22 [ 1789.667307][T27800] binder: 27799:27800 ioctl 40086602 20000000 returned -22 [ 1789.690604][T27811] binder: 27809:27811 ioctl 401c5820 20000000 returned -22 [ 1789.691620][T27810] binder: 27808:27810 ioctl 40086602 20000000 returned -22 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) io_setup(0x3, &(0x7f0000000000)=0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x3ff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x48) io_cancel(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x6, r2, &(0x7f0000000140)="f8b625e7f2983c0791db96b00e68f59d41a1b4b90a3bd604a292b62c71848fac808988388313752e813c3250d4713cc902e9e356b212487afd5c33b307b5e5b5aaee8ab73a8577acdcb43b1ea30695ba6f0a2ad1a759a07f6cf9a634f2a77be423c0bbd91bff82c5b701e9e96887e5c6cebb7492cf698b2ab3861a5678a218ddece0f0d63d7be442eca10465b3c8a50e7915d946a707b7117f5971a6f905fd8503ba988861bd1fff838ffdfb543e2849fc335f5158ad67594523c2885e9e4e705c541c525c3770ee6dc122141f1a", 0xce, 0x2, 0x0, 0x2}, &(0x7f0000000280)) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x600000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) [ 1789.718524][T27815] binder: 27813:27815 ioctl 40086602 20000000 returned -22 [ 1789.725299][T27819] binder: 27818:27819 ioctl 401c5820 20000000 returned -22 [ 1789.733039][T27820] binder: 27816:27820 ioctl 401c5820 20000000 returned -22 [ 1789.752634][T27826] binder: 27825:27826 ioctl 40086602 20000000 returned -22 [ 1789.752835][T27823] binder: 27821:27823 ioctl 40086602 20000000 returned -22 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x700000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) io_setup(0x3, &(0x7f0000000000)=0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x3ff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x48) io_cancel(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x6, r2, &(0x7f0000000140)="f8b625e7f2983c0791db96b00e68f59d41a1b4b90a3bd604a292b62c71848fac808988388313752e813c3250d4713cc902e9e356b212487afd5c33b307b5e5b5aaee8ab73a8577acdcb43b1ea30695ba6f0a2ad1a759a07f6cf9a634f2a77be423c0bbd91bff82c5b701e9e96887e5c6cebb7492cf698b2ab3861a5678a218ddece0f0d63d7be442eca10465b3c8a50e7915d946a707b7117f5971a6f905fd8503ba988861bd1fff838ffdfb543e2849fc335f5158ad67594523c2885e9e4e705c541c525c3770ee6dc122141f1a", 0xce, 0x2, 0x0, 0x2}, &(0x7f0000000280)) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1789.774816][T27831] binder: 27829:27831 ioctl 401c5820 20000000 returned -22 [ 1789.783278][T27833] binder: 27830:27833 ioctl 401c5820 20000000 returned -22 [ 1789.785992][T27835] binder: 27834:27835 ioctl 40086602 20000000 returned -22 [ 1789.807184][T27839] binder: 27836:27839 ioctl 40086602 20000000 returned -22 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.825633][T27848] binder: 27842:27848 ioctl 401c5820 20000000 returned -22 [ 1789.829737][T27847] binder: 27845:27847 ioctl 401c5820 20000000 returned -22 [ 1789.848247][T27853] binder: 27851:27853 ioctl 40086602 20000000 returned -22 [ 1789.857632][T27855] binder: 27854:27855 ioctl 401c5820 20000000 returned -22 [ 1789.867682][T27856] binder: 27849:27856 ioctl 40086602 20000000 returned -22 10:17:41 executing program 5: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x900000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) (async) io_setup(0x3, &(0x7f0000000000)=0x0) (async) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x3ff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x48) io_cancel(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x6, r2, &(0x7f0000000140)="f8b625e7f2983c0791db96b00e68f59d41a1b4b90a3bd604a292b62c71848fac808988388313752e813c3250d4713cc902e9e356b212487afd5c33b307b5e5b5aaee8ab73a8577acdcb43b1ea30695ba6f0a2ad1a759a07f6cf9a634f2a77be423c0bbd91bff82c5b701e9e96887e5c6cebb7492cf698b2ab3861a5678a218ddece0f0d63d7be442eca10465b3c8a50e7915d946a707b7117f5971a6f905fd8503ba988861bd1fff838ffdfb543e2849fc335f5158ad67594523c2885e9e4e705c541c525c3770ee6dc122141f1a", 0xce, 0x2, 0x0, 0x2}, &(0x7f0000000280)) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.870385][T27858] binder: 27857:27858 ioctl 401c5820 20000000 returned -22 [ 1789.897286][T27865] binder: 27863:27865 ioctl 40086602 20000000 returned -22 [ 1789.901046][T27867] binder: 27861:27867 ioctl 401c5820 20000000 returned -22 [ 1789.916611][T27866] binder: 27864:27866 ioctl 40086602 20000000 returned -22 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xa00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1789.932807][T27876] binder: 27875:27876 ioctl 401c5820 20000000 returned -22 [ 1789.936718][T27878] binder: 27877:27878 ioctl 40086602 20000000 returned -22 [ 1789.953923][T27880] binder: 27879:27880 ioctl 40086602 20000000 returned -22 [ 1789.954942][T27882] binder: 27881:27882 ioctl 401c5820 20000000 returned -22 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xb00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1789.982232][T27888] binder: 27887:27888 ioctl 40086602 20000000 returned -22 [ 1789.993103][T27886] binder: 27885:27886 ioctl 401c5820 20000000 returned -22 [ 1789.993625][T27892] binder: 27889:27892 ioctl 401c5820 20000000 returned -22 [ 1790.004247][T27894] binder: 27893:27894 ioctl 40086602 20000000 returned -22 [ 1790.023062][T27896] binder: 27895:27896 ioctl 401c5820 20000000 returned -22 10:17:41 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:41 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xc00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:41 executing program 1: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0011f100000007f9569cdf8a1f29000000"]}) 10:17:41 executing program 1: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0011f100000007f9569cdf8a1f29000000"]}) 10:17:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xd00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 1: ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0011f100000007f9569cdf8a1f29000000"]}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0011f100000007f9569cdf8a1f29000000"]}) (async) [ 1790.035745][T27900] binder: 27898:27900 ioctl 40086602 20000000 returned -22 [ 1790.040404][T27904] binder: 27903:27904 ioctl 40086602 20000000 returned -22 [ 1790.045372][T27899] binder: 27897:27899 ioctl 401c5820 20000000 returned -22 [ 1790.068125][T27910] binder: 27908:27910 ioctl 40086602 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xe00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$fuse(&(0x7f00000003c0), 0x0, 0x4000, &(0x7f0000000540)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x8}}, {@max_read={'max_read', 0x3d, 0x7fffffff}}, {@allow_other}, {@allow_other}], [{@smackfshat={'smackfshat', 0x3d, '&-'}}, {@euid_lt}, {@smackfsfloor={'smackfsfloor', 0x3d, '$*:,}'}}]}}, 0x1, 0x0, &(0x7f0000000680)="455a19da5f014fdc02f1ab719fec15bd6f9e0934de0f4b7e2bf414db2fee6077c7e4fe010ca5d45a188e164e952bee675fdc919455981125448d57a984ba0025cdfffe68a3afa6419cf34b31a9ec6c702fa8d703be804eaedf55488a88e64cad4cce59f35dc291c8c7382f519ff580f0ea092857bb908e11ffdb58edb0f8b0ec8ab34e6995830686c8eb404abe198016743dc1f66b") ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESDEC=r0, @ANYRES64=r1, @ANYBLOB="00020080ff0031f10000006400201f29", @ANYRES64]}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.092690][T27913] binder: 27912:27913 ioctl 401c5820 20000000 returned -22 [ 1790.098532][T27917] binder: 27916:27917 ioctl 401c5820 20000000 returned -22 [ 1790.109818][T27919] binder: 27911:27919 ioctl 40086602 20000000 returned -22 [ 1790.120306][T27921] binder: 27920:27921 ioctl 40086602 20000000 returned -22 [ 1790.129915][T27926] binder: 27925:27926 ioctl 40086602 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1000000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$fuse(&(0x7f00000003c0), 0x0, 0x4000, &(0x7f0000000540)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x8}}, {@max_read={'max_read', 0x3d, 0x7fffffff}}, {@allow_other}, {@allow_other}], [{@smackfshat={'smackfshat', 0x3d, '&-'}}, {@euid_lt}, {@smackfsfloor={'smackfsfloor', 0x3d, '$*:,}'}}]}}, 0x1, 0x0, &(0x7f0000000680)="455a19da5f014fdc02f1ab719fec15bd6f9e0934de0f4b7e2bf414db2fee6077c7e4fe010ca5d45a188e164e952bee675fdc919455981125448d57a984ba0025cdfffe68a3afa6419cf34b31a9ec6c702fa8d703be804eaedf55488a88e64cad4cce59f35dc291c8c7382f519ff580f0ea092857bb908e11ffdb58edb0f8b0ec8ab34e6995830686c8eb404abe198016743dc1f66b") (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESDEC=r0, @ANYRES64=r1, @ANYBLOB="00020080ff0031f10000006400201f29", @ANYRES64]}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$fuse(&(0x7f00000003c0), 0x0, 0x4000, &(0x7f0000000540)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x8}}, {@max_read={'max_read', 0x3d, 0x7fffffff}}, {@allow_other}, {@allow_other}], [{@smackfshat={'smackfshat', 0x3d, '&-'}}, {@euid_lt}, {@smackfsfloor={'smackfsfloor', 0x3d, '$*:,}'}}]}}, 0x1, 0x0, &(0x7f0000000680)="455a19da5f014fdc02f1ab719fec15bd6f9e0934de0f4b7e2bf414db2fee6077c7e4fe010ca5d45a188e164e952bee675fdc919455981125448d57a984ba0025cdfffe68a3afa6419cf34b31a9ec6c702fa8d703be804eaedf55488a88e64cad4cce59f35dc291c8c7382f519ff580f0ea092857bb908e11ffdb58edb0f8b0ec8ab34e6995830686c8eb404abe198016743dc1f66b") ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESDEC=r0, @ANYRES64=r1, @ANYBLOB="00020080ff0031f10000006400201f29", @ANYRES64]}) socket$inet_udp(0x2, 0x2, 0x0) (async) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f00000003c0), 0x0, 0x4000, &(0x7f0000000540)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x8}}, {@max_read={'max_read', 0x3d, 0x7fffffff}}, {@allow_other}, {@allow_other}], [{@smackfshat={'smackfshat', 0x3d, '&-'}}, {@euid_lt}, {@smackfsfloor={'smackfsfloor', 0x3d, '$*:,}'}}]}}, 0x1, 0x0, &(0x7f0000000680)="455a19da5f014fdc02f1ab719fec15bd6f9e0934de0f4b7e2bf414db2fee6077c7e4fe010ca5d45a188e164e952bee675fdc919455981125448d57a984ba0025cdfffe68a3afa6419cf34b31a9ec6c702fa8d703be804eaedf55488a88e64cad4cce59f35dc291c8c7382f519ff580f0ea092857bb908e11ffdb58edb0f8b0ec8ab34e6995830686c8eb404abe198016743dc1f66b") (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)=ANY=[@ANYRESDEC=r0, @ANYRES64=r1, @ANYBLOB="00020080ff0031f10000006400201f29", @ANYRES64]}) (async) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00000080ff0031f10000000645030014006400201f29ae89397a22daf672a2a05f6915d95be2416dde2d4f40263373978068f68f0734cb3fa2a4c86a09e82a0ca23ed6781320d29be50d74fde273aa6b426541420e4270c068d274589b0c6603432b0481fbde3c54a3042c17bb1917d1e5ee35d6b5338aacdb07fbda69883b5448285243272d929dd0f663cd2df140f193c500b03989503f10365bd614a7b863df15a464afc32dec3e6854896114110ad675f1c68cba661c4e512bb6a9336e2526fabb7924110665eb19380143d713e59e8a3ce5c07dae10c68cfd083873a029d9420fc025c7b0c48be8eccdf7c007e12eb380b6"]}) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x301003) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x8000000) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f0000000040), &(0x7f0000000100)=0x4) mount_setattr(r1, &(0x7f0000000000)='./file0\x00', 0x8800, &(0x7f00000000c0)={0x5, 0x0, 0x120000, {r0}}, 0x20) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1100000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.150548][T27930] binder: 27927:27930 ioctl 401c5820 20000000 returned -22 [ 1790.170434][T27940] binder: 27939:27940 ioctl 401c5820 20000000 returned -22 [ 1790.178676][T27938] binder: 27933:27938 ioctl 40086602 20000000 returned -22 [ 1790.178733][T27941] binder: 27934:27941 ioctl 40086602 20000000 returned -22 [ 1790.193290][T27948] binder: 27947:27948 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00000080ff0031f10000000645030014006400201f29ae89397a22daf672a2a05f6915d95be2416dde2d4f40263373978068f68f0734cb3fa2a4c86a09e82a0ca23ed6781320d29be50d74fde273aa6b426541420e4270c068d274589b0c6603432b0481fbde3c54a3042c17bb1917d1e5ee35d6b5338aacdb07fbda69883b5448285243272d929dd0f663cd2df140f193c500b03989503f10365bd614a7b863df15a464afc32dec3e6854896114110ad675f1c68cba661c4e512bb6a9336e2526fabb7924110665eb19380143d713e59e8a3ce5c07dae10c68cfd083873a029d9420fc025c7b0c48be8eccdf7c007e12eb380b6"]}) (async) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x301003) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x8000000) (async) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f0000000040), &(0x7f0000000100)=0x4) (async) mount_setattr(r1, &(0x7f0000000000)='./file0\x00', 0x8800, &(0x7f00000000c0)={0x5, 0x0, 0x120000, {r0}}, 0x20) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="00000080ff0031f10000000645030014006400201f29ae89397a22daf672a2a05f6915d95be2416dde2d4f40263373978068f68f0734cb3fa2a4c86a09e82a0ca23ed6781320d29be50d74fde273aa6b426541420e4270c068d274589b0c6603432b0481fbde3c54a3042c17bb1917d1e5ee35d6b5338aacdb07fbda69883b5448285243272d929dd0f663cd2df140f193c500b03989503f10365bd614a7b863df15a464afc32dec3e6854896114110ad675f1c68cba661c4e512bb6a9336e2526fabb7924110665eb19380143d713e59e8a3ce5c07dae10c68cfd083873a029d9420fc025c7b0c48be8eccdf7c007e12eb380b6"]}) (async) r1 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x301003) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x8000000) (async) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_LOOPBACK(r2, 0x65, 0x3, &(0x7f0000000040), &(0x7f0000000100)=0x4) (async) mount_setattr(r1, &(0x7f0000000000)='./file0\x00', 0x8800, &(0x7f00000000c0)={0x5, 0x0, 0x120000, {r0}}, 0x20) [ 1790.212157][T27953] binder: 27952:27953 ioctl 40086602 20000000 returned -22 [ 1790.227790][T27956] binder: 27954:27956 ioctl 401c5820 20000000 returned -22 [ 1790.239113][T27963] binder: 27962:27963 ioctl 40086602 20000000 returned -22 [ 1790.247307][T27966] binder: 27965:27966 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x8000000) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1200000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1790.258671][T27969] binder: 27968:27969 ioctl 40086602 20000000 returned -22 [ 1790.282081][T27977] binder: 27974:27977 ioctl 401c5820 20000000 returned -22 [ 1790.293249][T27980] binder: 27978:27980 ioctl 40086602 20000000 returned -22 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x8000000) 10:17:42 executing program 1: r0 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:42 executing program 1: r0 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) (async) sendmsg$BATADV_CMD_GET_ORIGINATORS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x8001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='yyztnl0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="00000080ff0031f10000000645030014006400201f29"]}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x1800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x8000000) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.314459][T27987] binder: 27986:27987 ioctl 40086602 20000000 returned -22 [ 1790.326446][T27995] binder: 27989:27995 ioctl 401c5820 20000000 returned -22 [ 1790.328659][T27991] binder: 27988:27991 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x2500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x2500000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) [ 1790.359829][T28006] binder: 28005:28006 ioctl 40086602 20000000 returned -22 [ 1790.367851][T28004] binder: 28001:28004 ioctl 40086602 20000000 returned -22 [ 1790.380484][T28010] binder: 28009:28010 ioctl 401c5820 20000000 returned -22 [ 1790.390475][T28012] binder: 28011:28012 ioctl 401c5820 20000000 returned -22 [ 1790.399535][T28016] binder: 28015:28016 ioctl 40086602 20000000 returned -22 [ 1790.399892][T28017] binder: 28013:28017 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.410379][T28019] binder: 28018:28019 ioctl 40086602 20000000 returned -22 [ 1790.438475][T28024] binder: 28023:28024 ioctl 401c5820 20000000 returned -22 [ 1790.440423][T28026] binder: 28025:28026 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x18000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x4c00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.461433][T28030] binder: 28029:28030 ioctl 40086602 20000000 returned -22 [ 1790.469599][T28028] binder: 28027:28028 ioctl 401c5820 20000000 returned -22 [ 1790.472091][T28032] binder: 28031:28032 ioctl 401c5820 20000000 returned -22 [ 1790.487582][T28036] binder: 28034:28036 ioctl 40086602 20000000 returned -22 [ 1790.487642][T28035] binder: 28033:28035 ioctl 401c5820 20000000 returned -22 [ 1790.500083][T28038] binder: 28037:28038 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.516868][T28041] binder: 28040:28041 ioctl 401c5820 20000000 returned -22 [ 1790.516878][T28042] binder: 28039:28042 ioctl 40086602 20000000 returned -22 [ 1790.534926][T28044] binder: 28043:28044 ioctl 40086602 20000000 returned -22 [ 1790.536395][T28046] binder: 28045:28046 ioctl 40086602 20000000 returned -22 [ 1790.554049][T28048] binder: 28047:28048 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6800000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.559918][T28050] binder: 28049:28050 ioctl 401c5820 20000000 returned -22 [ 1790.571062][T28052] binder: 28051:28052 ioctl 40086602 20000000 returned -22 [ 1790.585446][T28055] binder: 28054:28055 ioctl 401c5820 20000000 returned -22 [ 1790.588624][T28058] binder: 28056:28058 ioctl 401c5820 20000000 returned -22 [ 1790.594220][T28059] binder: 28053:28059 ioctl 40086602 20000000 returned -22 [ 1790.601194][T28060] binder: 28057:28060 ioctl 40086602 20000000 returned -22 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x6c00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.625188][T28064] binder: 28063:28064 ioctl 401c5820 20000000 returned -22 [ 1790.642755][T28071] binder: 28065:28071 ioctl 40086602 20000000 returned -22 [ 1790.650464][T28072] binder: 28067:28072 ioctl 40086602 20000000 returned -22 [ 1790.657612][T28069] binder: 28068:28069 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7400000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1790.670285][T28076] binder: 28075:28076 ioctl 401c5820 20000000 returned -22 [ 1790.674156][T28079] binder: 28078:28079 ioctl 401c5820 20000000 returned -22 [ 1790.693449][T28082] binder: 28081:28082 ioctl 40086602 20000000 returned -22 [ 1790.703276][T28084] binder: 28080:28084 ioctl 40086602 20000000 returned -22 [ 1790.708880][T28085] binder: 28083:28085 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x7a00000000000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406f00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1790.719773][T28087] binder: 28086:28087 ioctl 401c5820 20000000 returned -22 [ 1790.729667][T28091] binder: 28090:28091 ioctl 401c5820 20000000 returned -22 [ 1790.742493][T28093] binder: 28092:28093 ioctl 40086602 20000000 returned -22 [ 1790.765370][T28097] binder: 28096:28097 ioctl 40086602 20000000 returned -22 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xffffffff00000000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1790.772737][T28099] binder: 28098:28099 ioctl 401c5820 20000000 returned -22 [ 1790.774278][T28104] binder: 28102:28104 ioctl 401c5820 20000000 returned -22 [ 1790.785313][T28106] binder: 28105:28106 ioctl 40086602 20000000 returned -22 [ 1790.787649][T28101] binder: 28100:28101 ioctl 401c5820 20000000 returned -22 [ 1790.810901][T28109] binder: 28108:28109 ioctl 40086602 20000000 returned -22 [ 1790.818165][T28115] binder: 28114:28115 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:42 executing program 1: mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0xffffffffff600000, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1790.822254][T28113] binder: 28112:28113 ioctl 40086602 20000000 returned -22 [ 1790.844058][T28119] binder: 28116:28119 ioctl 401c5820 20000000 returned -22 [ 1790.860357][T28123] binder: 28121:28123 ioctl 40086602 20000000 returned -22 [ 1790.862492][T28125] binder: 28122:28125 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.874714][T28128] binder: 28126:28128 ioctl 40086602 20000000 returned -22 [ 1790.876796][T28129] binder: 28127:28129 ioctl 401c5820 20000000 returned -22 [ 1790.896885][T28131] binder: 28130:28131 ioctl 40086602 20000000 returned -22 [ 1790.907133][T28133] binder: 28132:28133 ioctl 40086602 20000000 returned -22 [ 1790.918594][T28136] binder: 28135:28136 ioctl 401c5820 20000000 returned -22 10:17:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0xc00, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1790.934362][T28141] binder: 28140:28141 ioctl 401c5820 20000000 returned -22 [ 1790.947229][T28145] binder: 28144:28145 ioctl 40086602 20000000 returned -22 [ 1790.955846][T28148] binder: 28147:28148 ioctl 40086602 20000000 returned -22 [ 1790.956006][T28149] binder: 28146:28149 ioctl 40086602 20000000 returned -22 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:42 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 1) 10:17:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1790.981582][T28153] binder: 28152:28153 ioctl 40086602 20000000 returned -22 [ 1790.990212][T28155] binder: 28154:28155 ioctl 401c5820 20000000 returned -22 [ 1790.999064][T28158] binder: 28156:28158 ioctl 401c5820 20000000 returned -22 [ 1791.009153][T28160] FAULT_INJECTION: forcing a failure. [ 1791.009153][T28160] name failslab, interval 1, probability 0, space 0, times 0 [ 1791.017296][T28163] binder: 28162:28163 ioctl 40086602 20000000 returned -22 10:17:42 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402500, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:42 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1791.038042][T28168] binder: 28164:28168 ioctl 401c5820 20000000 returned -22 [ 1791.041826][T28169] binder: 28165:28169 ioctl 401c5820 20000000 returned -22 [ 1791.052922][T28160] CPU: 1 PID: 28160 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1791.062902][T28160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1791.065089][T28171] binder: 28170:28171 ioctl 40086602 20000000 returned -22 [ 1791.072879][T28160] Call Trace: [ 1791.072891][T28160] 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402a00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402b00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.072899][T28160] dump_stack_lvl+0x151/0x1b7 [ 1791.072927][T28160] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1791.072951][T28160] dump_stack+0x15/0x1e [ 1791.072968][T28160] should_fail_ex+0x3d0/0x520 [ 1791.104133][T28160] ? vm_area_dup+0x27/0x290 [ 1791.108469][T28160] __should_failslab+0xaf/0xf0 [ 1791.111632][T28179] binder: 28177:28179 ioctl 40086602 20000000 returned -22 [ 1791.113060][T28160] should_failslab+0x9/0x20 [ 1791.113088][T28160] kmem_cache_alloc+0x3b/0x2c0 [ 1791.129038][T28160] vm_area_dup+0x27/0x290 [ 1791.133204][T28160] ? __split_vma+0x1a1/0x880 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402d00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40402e00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.134069][T28182] binder: 28181:28182 ioctl 40086602 20000000 returned -22 [ 1791.137626][T28160] __split_vma+0x1ba/0x880 [ 1791.137659][T28160] do_mas_align_munmap+0x3bf/0x1400 [ 1791.137682][T28160] ? kernel_text_address+0xa9/0xe0 [ 1791.156281][T28185] binder: 28184:28185 ioctl 40086602 20000000 returned -22 [ 1791.158888][T28160] ? __kernel_text_address+0xd/0x40 [ 1791.158926][T28160] ? avc_has_perm_noaudit+0x348/0x430 [ 1791.176261][T28160] ? do_mas_munmap+0x2b0/0x2b0 [ 1791.177482][T28189] binder: 28187:28189 ioctl 40086602 20000000 returned -22 [ 1791.180864][T28160] ? mas_find+0x4e4/0x520 [ 1791.180896][T28160] do_mas_munmap+0x23e/0x2b0 [ 1791.197079][T28160] mmap_region+0x75c/0x2390 [ 1791.201591][T28160] ? file_mmap_ok+0x150/0x150 [ 1791.206102][T28160] ? cap_mmap_addr+0x169/0x2e0 [ 1791.210700][T28160] ? __kasan_check_read+0x11/0x20 [ 1791.215559][T28160] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1791.221026][T28160] ? arch_get_unmapped_area+0x780/0x780 [ 1791.226410][T28160] ? file_mmap_ok+0x104/0x150 [ 1791.230923][T28160] do_mmap+0x853/0xe30 [ 1791.234831][T28160] ? mlock_future_check+0x110/0x110 [ 1791.239863][T28160] vm_mmap_pgoff+0x208/0x430 [ 1791.244292][T28160] ? account_locked_vm+0x250/0x250 [ 1791.249236][T28160] ? __fget_files+0x2cb/0x330 [ 1791.253750][T28160] ksys_mmap_pgoff+0x15d/0x1e0 [ 1791.258554][T28160] __x64_sys_mmap+0x103/0x120 [ 1791.263077][T28160] do_syscall_64+0x3d/0xb0 [ 1791.267311][T28160] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1791.273039][T28160] RIP: 0033:0x7f2a38e7cda9 [ 1791.277301][T28160] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1791.296737][T28160] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1791.304991][T28160] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1791.312806][T28160] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1791.320613][T28160] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 [ 1791.328413][T28160] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x8000000) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40403000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.336393][T28160] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1791.344211][T28160] [ 1791.368265][T28196] binder: 28191:28196 ioctl 401c5820 20000000 returned -22 [ 1791.375423][T28195] binder: 28193:28195 ioctl 40086602 20000000 returned -22 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x8000000) 10:17:43 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 2) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40404c00, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.387020][T28194] binder: 28192:28194 ioctl 401c5820 20000000 returned -22 [ 1791.393946][T28202] binder: 28201:28202 ioctl 40086602 20000000 returned -22 [ 1791.416181][T28206] FAULT_INJECTION: forcing a failure. [ 1791.416181][T28206] name failslab, interval 1, probability 0, space 0, times 0 [ 1791.426399][T28209] binder: 28207:28209 ioctl 401c5820 20000000 returned -22 [ 1791.429324][T28206] CPU: 0 PID: 28206 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1791.441591][T28210] binder: 28208:28210 ioctl 401c5820 20000000 returned -22 [ 1791.445599][T28206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1791.445617][T28206] Call Trace: [ 1791.445623][T28206] [ 1791.445630][T28206] dump_stack_lvl+0x151/0x1b7 [ 1791.464470][T28213] binder: 28212:28213 ioctl 401c5820 20000000 returned -22 [ 1791.466780][T28206] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1791.466814][T28206] dump_stack+0x15/0x1e [ 1791.475545][T28215] binder: 28214:28215 ioctl 401c5820 20000000 returned -22 [ 1791.481187][T28206] should_fail_ex+0x3d0/0x520 [ 1791.481218][T28206] ? vm_area_dup+0x65/0x290 [ 1791.481239][T28206] __should_failslab+0xaf/0xf0 [ 1791.494208][T28217] binder: 28216:28217 ioctl 40086602 20000000 returned -22 [ 1791.497506][T28206] should_failslab+0x9/0x20 [ 1791.497537][T28206] kmem_cache_alloc+0x3b/0x2c0 [ 1791.523574][T28219] binder: 28218:28219 ioctl 401c5820 20000000 returned -22 [ 1791.526942][T28206] vm_area_dup+0x65/0x290 [ 1791.526975][T28206] __split_vma+0x1ba/0x880 [ 1791.542472][T28206] do_mas_align_munmap+0x3bf/0x1400 [ 1791.545234][T28224] binder: 28221:28224 ioctl 401c5820 20000000 returned -22 [ 1791.547499][T28206] ? kernel_text_address+0xa9/0xe0 [ 1791.547533][T28206] ? __kernel_text_address+0xd/0x40 [ 1791.554814][T28223] binder: 28222:28223 ioctl 40086602 20000000 returned -22 [ 1791.559470][T28206] ? avc_has_perm_noaudit+0x348/0x430 [ 1791.559498][T28206] ? do_mas_munmap+0x2b0/0x2b0 [ 1791.581351][T28206] ? mas_find+0x4e4/0x520 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.584089][T28226] binder: 28225:28226 ioctl 40086602 20000000 returned -22 [ 1791.585507][T28206] do_mas_munmap+0x23e/0x2b0 [ 1791.596971][T28206] mmap_region+0x75c/0x2390 [ 1791.601310][T28206] ? file_mmap_ok+0x150/0x150 [ 1791.605820][T28206] ? cap_mmap_addr+0x169/0x2e0 [ 1791.610419][T28206] ? __kasan_check_read+0x11/0x20 [ 1791.615279][T28206] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1791.615307][T28230] binder: 28229:28230 ioctl 401c5820 20000000 returned -22 [ 1791.620745][T28206] ? arch_get_unmapped_area+0x780/0x780 [ 1791.620780][T28206] ? file_mmap_ok+0x104/0x150 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.631699][T28232] binder: 28231:28232 ioctl 40086602 20000000 returned -22 [ 1791.633154][T28206] do_mmap+0x853/0xe30 [ 1791.633186][T28206] ? mlock_future_check+0x110/0x110 [ 1791.649653][T28234] binder: 28233:28234 ioctl 40086602 20000000 returned -22 [ 1791.653642][T28206] vm_mmap_pgoff+0x208/0x430 [ 1791.653674][T28206] ? account_locked_vm+0x250/0x250 [ 1791.666484][T28236] binder: 28235:28236 ioctl 401c5820 20000000 returned -22 [ 1791.670042][T28206] ? __fget_files+0x2cb/0x330 [ 1791.670074][T28206] ksys_mmap_pgoff+0x15d/0x1e0 [ 1791.686196][T28206] __x64_sys_mmap+0x103/0x120 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.688166][T28238] binder: 28237:28238 ioctl 40086602 20000000 returned -22 [ 1791.690701][T28206] do_syscall_64+0x3d/0xb0 [ 1791.701987][T28206] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1791.707716][T28206] RIP: 0033:0x7f2a38e7cda9 [ 1791.709927][T28240] binder: 28239:28240 ioctl 401c5820 20000000 returned -22 [ 1791.711962][T28206] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40405800, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x8000000) [ 1791.711983][T28206] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1791.724735][T28242] binder: 28241:28242 ioctl 40086602 20000000 returned -22 [ 1791.738433][T28206] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1791.738454][T28206] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1791.738467][T28206] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 [ 1791.738478][T28206] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.738489][T28206] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1791.738506][T28206] [ 1791.773679][T28247] binder: 28246:28247 ioctl 40086602 20000000 returned -22 [ 1791.779270][T28248] binder: 28243:28248 ioctl 401c5820 20000000 returned -22 [ 1791.801928][T28252] binder: 28251:28252 ioctl 40086602 20000000 returned -22 [ 1791.805596][T28253] binder: 28245:28253 ioctl 40086602 20000000 returned -22 [ 1791.810369][T28244] binder: 28228:28244 ioctl 401c5820 20000000 returned -22 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 3) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406303, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.841643][T28256] binder: 28255:28256 ioctl 40086602 20000000 returned -22 [ 1791.848010][T28260] binder: 28257:28260 ioctl 401c5820 20000000 returned -22 [ 1791.850932][T28261] binder: 28258:28261 ioctl 40086602 20000000 returned -22 [ 1791.875622][T28265] binder: 28264:28265 ioctl 40086602 20000000 returned -22 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, 0xffffffffffffffff, 0x8000000) 10:17:43 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 1) 10:17:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.887099][T28270] FAULT_INJECTION: forcing a failure. [ 1791.887099][T28270] name failslab, interval 1, probability 0, space 0, times 0 [ 1791.892931][T28272] binder: 28271:28272 ioctl 40086602 20000000 returned -22 [ 1791.900121][T28268] binder: 28267:28268 ioctl 401c5820 20000000 returned -22 [ 1791.916308][T28270] CPU: 0 PID: 28270 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1791.926291][T28270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1791.936192][T28270] Call Trace: [ 1791.939308][T28270] 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406304, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406305, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406306, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.942094][T28270] dump_stack_lvl+0x151/0x1b7 [ 1791.946607][T28270] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1791.950738][T28280] binder: 28279:28280 ioctl 40086602 20000000 returned -22 [ 1791.951897][T28270] ? __kernel_text_address+0xd/0x40 [ 1791.963961][T28270] dump_stack+0x15/0x1e [ 1791.967952][T28270] should_fail_ex+0x3d0/0x520 [ 1791.970213][T28283] binder: 28282:28283 ioctl 40086602 20000000 returned -22 [ 1791.972462][T28270] ? mas_alloc_nodes+0x267/0x7d0 [ 1791.972496][T28270] __should_failslab+0xaf/0xf0 10:17:43 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406307, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1791.988872][T28270] should_failslab+0x9/0x20 [ 1791.993212][T28270] kmem_cache_alloc+0x3b/0x2c0 [ 1791.995689][T28286] FAULT_INJECTION: forcing a failure. [ 1791.995689][T28286] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1791.997806][T28270] mas_alloc_nodes+0x267/0x7d0 [ 1791.997838][T28270] mas_preallocate+0xef2/0x1bd0 [ 1792.011531][T28287] binder: 28285:28287 ioctl 40086602 20000000 returned -22 [ 1792.015256][T28270] ? mas_destroy+0x3280/0x3280 [ 1792.015287][T28270] ? rwsem_write_trylock+0x15b/0x290 [ 1792.036694][T28270] __vma_adjust+0x6aa/0x1fe0 [ 1792.041120][T28270] ? vma_start_write+0x160/0x160 [ 1792.045886][T28270] ? rwsem_write_trylock+0x15b/0x290 [ 1792.051011][T28270] __split_vma+0x619/0x880 [ 1792.055260][T28270] do_mas_align_munmap+0x3bf/0x1400 [ 1792.060294][T28270] ? kernel_text_address+0xa9/0xe0 [ 1792.065239][T28270] ? __kernel_text_address+0xd/0x40 [ 1792.070273][T28270] ? avc_has_perm_noaudit+0x348/0x430 [ 1792.075482][T28270] ? do_mas_munmap+0x2b0/0x2b0 [ 1792.080083][T28270] ? mas_find+0x4e4/0x520 [ 1792.084252][T28270] do_mas_munmap+0x23e/0x2b0 [ 1792.088676][T28270] mmap_region+0x75c/0x2390 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.093017][T28270] ? file_mmap_ok+0x150/0x150 [ 1792.097528][T28270] ? cap_mmap_addr+0x169/0x2e0 [ 1792.102386][T28270] ? __kasan_check_read+0x11/0x20 [ 1792.107247][T28270] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1792.112712][T28270] ? arch_get_unmapped_area+0x780/0x780 [ 1792.118096][T28270] ? file_mmap_ok+0x104/0x150 [ 1792.122607][T28270] do_mmap+0x853/0xe30 [ 1792.126521][T28270] ? mlock_future_check+0x110/0x110 [ 1792.131551][T28270] vm_mmap_pgoff+0x208/0x430 [ 1792.135982][T28270] ? account_locked_vm+0x250/0x250 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406308, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.140983][T28270] ? __fget_files+0x2cb/0x330 [ 1792.142415][T28294] binder: 28293:28294 ioctl 401c5820 20000000 returned -22 [ 1792.145447][T28270] ksys_mmap_pgoff+0x15d/0x1e0 [ 1792.145480][T28270] __x64_sys_mmap+0x103/0x120 [ 1792.161582][T28270] do_syscall_64+0x3d/0xb0 [ 1792.165831][T28270] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1792.171560][T28270] RIP: 0033:0x7f2a38e7cda9 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.175817][T28270] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1792.195258][T28270] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1792.196932][T28301] binder: 28300:28301 ioctl 401c5820 20000000 returned -22 [ 1792.203498][T28270] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1792.203520][T28270] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1792.203532][T28270] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 [ 1792.203543][T28270] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1792.203555][T28270] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1792.249595][T28270] [ 1792.251296][T28304] binder: 28303:28304 ioctl 401c5820 20000000 returned -22 [ 1792.254434][T28305] binder: 28284:28305 ioctl 401c5820 20000000 returned -22 [ 1792.260359][T28286] CPU: 1 PID: 28286 Comm: syz-executor.1 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1792.276581][T28286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1792.284511][T28307] binder: 28306:28307 ioctl 401c5820 20000000 returned -22 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.286473][T28286] Call Trace: [ 1792.286484][T28286] [ 1792.286491][T28286] dump_stack_lvl+0x151/0x1b7 [ 1792.286517][T28286] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1792.286539][T28286] ? __kasan_check_write+0x14/0x20 [ 1792.306623][T28309] binder: 28308:28309 ioctl 401c5820 20000000 returned -22 [ 1792.309212][T28286] dump_stack+0x15/0x1e [ 1792.324786][T28311] binder: 28310:28311 ioctl 401c5820 20000000 returned -22 [ 1792.325177][T28286] should_fail_ex+0x3d0/0x520 [ 1792.337253][T28286] should_fail+0xb/0x10 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.341339][T28286] should_fail_usercopy+0x1a/0x20 [ 1792.343828][T28313] binder: 28312:28313 ioctl 401c5820 20000000 returned -22 [ 1792.346538][T28286] _copy_to_user+0x1e/0x90 [ 1792.346563][T28286] simple_read_from_buffer+0xc7/0x150 [ 1792.346585][T28286] proc_fail_nth_read+0x1a3/0x210 [ 1792.367895][T28286] ? proc_fault_inject_write+0x390/0x390 [ 1792.373363][T28286] ? fsnotify_perm+0x470/0x5d0 [ 1792.377961][T28286] ? security_file_permission+0x86/0xb0 [ 1792.381312][T28315] binder: 28314:28315 ioctl 401c5820 20000000 returned -22 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.383341][T28286] ? proc_fault_inject_write+0x390/0x390 [ 1792.395927][T28286] vfs_read+0x26c/0xad0 [ 1792.399920][T28286] ? kernel_read+0x1f0/0x1f0 [ 1792.404343][T28286] ? mutex_lock+0xb1/0x1e0 [ 1792.408597][T28286] ? bit_wait_io_timeout+0x120/0x120 [ 1792.410198][T28317] binder: 28316:28317 ioctl 401c5820 20000000 returned -22 [ 1792.413718][T28286] ? __fdget_pos+0x2e2/0x390 [ 1792.425263][T28286] ? ksys_read+0x77/0x2c0 [ 1792.429430][T28286] ksys_read+0x199/0x2c0 [ 1792.433509][T28286] ? vfs_write+0xeb0/0xeb0 [ 1792.437759][T28286] ? debug_smp_processor_id+0x17/0x20 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.440813][T28319] binder: 28318:28319 ioctl 401c5820 20000000 returned -22 [ 1792.442974][T28286] ? fpregs_assert_state_consistent+0xb6/0xe0 [ 1792.455990][T28286] __x64_sys_read+0x7b/0x90 [ 1792.460324][T28286] do_syscall_64+0x3d/0xb0 [ 1792.464585][T28286] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1792.470113][T28321] binder: 28320:28321 ioctl 401c5820 20000000 returned -22 [ 1792.470386][T28286] RIP: 0033:0x7f36ce07ba4c 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.481678][T28286] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 59 81 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 af 81 02 00 48 [ 1792.497322][T28323] binder: 28322:28323 ioctl 401c5820 20000000 returned -22 [ 1792.501112][T28286] RSP: 002b:00007f36cd3de0c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1792.501138][T28286] RAX: ffffffffffffffda RBX: 00007f36ce1ac050 RCX: 00007f36ce07ba4c [ 1792.524206][T28286] RDX: 000000000000000f RSI: 00007f36cd3de130 RDI: 0000000000000003 [ 1792.529250][T28325] binder: 28324:28325 ioctl 401c5820 20000000 returned -22 10:17:44 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 4) 10:17:44 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x18000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406309, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.532010][T28286] RBP: 00007f36cd3de120 R08: 0000000000000000 R09: 0000000008000000 [ 1792.532029][T28286] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1792.554667][T28286] R13: 000000000000006e R14: 00007f36ce1ac050 R15: 00007ffec030a058 [ 1792.558877][T28327] binder: 28326:28327 ioctl 401c5820 20000000 returned -22 [ 1792.562477][T28286] [ 1792.585788][T28332] binder: 28330:28332 ioctl 40086602 20000000 returned -22 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) [ 1792.588327][T28333] binder: 28331:28333 ioctl 40086602 20000000 returned -22 [ 1792.600867][T28329] binder: 28328:28329 ioctl 401c5820 20000000 returned -22 [ 1792.609334][T28335] FAULT_INJECTION: forcing a failure. [ 1792.609334][T28335] name failslab, interval 1, probability 0, space 0, times 0 [ 1792.609820][T28337] binder: 28336:28337 ioctl 401c5820 20000000 returned -22 [ 1792.626342][T28335] CPU: 0 PID: 28335 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1792.638755][T28335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1792.648647][T28335] Call Trace: [ 1792.651454][T28343] binder: 28342:28343 ioctl 40086602 20000000 returned -22 [ 1792.651762][T28335] [ 1792.661576][T28335] dump_stack_lvl+0x151/0x1b7 [ 1792.666086][T28335] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1792.667060][T28345] binder: 28344:28345 ioctl 401c5820 20000000 returned -22 [ 1792.671378][T28335] dump_stack+0x15/0x1e [ 1792.671408][T28335] should_fail_ex+0x3d0/0x520 [ 1792.686313][T28347] binder: 28346:28347 ioctl 40086602 20000000 returned -22 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040630a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.686915][T28335] ? vm_area_dup+0x27/0x290 [ 1792.686945][T28335] __should_failslab+0xaf/0xf0 [ 1792.702973][T28335] should_failslab+0x9/0x20 [ 1792.705742][T28350] binder: 28349:28350 ioctl 401c5820 20000000 returned -22 [ 1792.707308][T28335] kmem_cache_alloc+0x3b/0x2c0 [ 1792.707341][T28335] vm_area_dup+0x27/0x290 [ 1792.707363][T28335] ? __split_vma+0x1a1/0x880 [ 1792.727537][T28335] __split_vma+0x1ba/0x880 [ 1792.729035][T28352] binder: 28351:28352 ioctl 40086602 20000000 returned -22 [ 1792.731787][T28335] do_mas_align_munmap+0x85b/0x1400 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1792.731821][T28335] ? kernel_text_address+0xa9/0xe0 [ 1792.748978][T28335] ? do_mas_munmap+0x2b0/0x2b0 [ 1792.751567][T28356] binder: 28355:28356 ioctl 40086602 20000000 returned -22 [ 1792.753584][T28335] ? mas_find+0x4e4/0x520 [ 1792.753617][T28335] do_mas_munmap+0x23e/0x2b0 [ 1792.769197][T28335] mmap_region+0x75c/0x2390 [ 1792.771824][T28359] binder: 28358:28359 ioctl 40086602 20000000 returned -22 [ 1792.773534][T28335] ? file_mmap_ok+0x150/0x150 [ 1792.773567][T28335] ? cap_mmap_addr+0x169/0x2e0 [ 1792.789685][T28335] ? __kasan_check_read+0x11/0x20 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2002, 0x0, 0x13, r0, 0x8000000) 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040630b, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.794625][T28335] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1792.800115][T28335] ? arch_get_unmapped_area+0x780/0x780 [ 1792.805478][T28335] ? file_mmap_ok+0x104/0x150 [ 1792.809984][T28335] do_mmap+0x853/0xe30 [ 1792.813889][T28335] ? mlock_future_check+0x110/0x110 [ 1792.818922][T28335] vm_mmap_pgoff+0x208/0x430 [ 1792.823356][T28335] ? account_locked_vm+0x250/0x250 [ 1792.828302][T28335] ? __fget_files+0x2cb/0x330 [ 1792.832816][T28335] ksys_mmap_pgoff+0x15d/0x1e0 [ 1792.837415][T28335] __x64_sys_mmap+0x103/0x120 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2004, 0x0, 0x13, r0, 0x8000000) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x200a, 0x0, 0x13, r0, 0x8000000) 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x200d, 0x0, 0x13, r0, 0x8000000) 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x200e, 0x0, 0x13, r0, 0x8000000) [ 1792.840328][T28363] binder: 28353:28363 ioctl 401c5820 20000000 returned -22 [ 1792.841920][T28335] do_syscall_64+0x3d/0xb0 [ 1792.853209][T28335] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1792.858933][T28335] RIP: 0033:0x7f2a38e7cda9 [ 1792.863188][T28335] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1792.882727][T28335] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x200f, 0x0, 0x13, r0, 0x8000000) 10:17:44 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 5) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.890967][T28335] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1792.898947][T28335] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1792.901347][T28370] binder: 28364:28370 ioctl 40086602 20000000 returned -22 [ 1792.906755][T28335] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 [ 1792.906775][T28335] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1792.906787][T28335] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1792.906802][T28335] 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040630c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1792.915044][T28373] binder: 28371:28373 ioctl 401c5820 20000000 returned -22 [ 1792.934053][T28378] binder: 28366:28378 ioctl 40086602 20000000 returned -22 [ 1792.937692][T28375] binder: 28362:28375 ioctl 401c5820 20000000 returned -22 [ 1792.953368][T28385] binder: 28384:28385 ioctl 40086602 20000000 returned -22 [ 1792.966911][T28388] binder: 28387:28388 ioctl 40086602 20000000 returned -22 [ 1792.977836][T28382] FAULT_INJECTION: forcing a failure. [ 1792.977836][T28382] name failslab, interval 1, probability 0, space 0, times 0 10:17:44 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2021, 0x0, 0x13, r0, 0x8000000) 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1792.991319][T28390] binder: 28389:28390 ioctl 401c5820 20000000 returned -22 [ 1793.001772][T28394] binder: 28392:28394 ioctl 40086602 20000000 returned -22 [ 1793.003174][T28382] CPU: 0 PID: 28382 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1793.009019][T28393] binder: 28391:28393 ioctl 401c5820 20000000 returned -22 [ 1793.018840][T28382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1793.018857][T28382] Call Trace: [ 1793.018863][T28382] [ 1793.018870][T28382] dump_stack_lvl+0x151/0x1b7 10:17:44 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040630e, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:44 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.018899][T28382] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1793.018925][T28382] dump_stack+0x15/0x1e [ 1793.018944][T28382] should_fail_ex+0x3d0/0x520 [ 1793.046278][T28398] binder: 28396:28398 ioctl 40086602 20000000 returned -22 [ 1793.046511][T28382] ? vm_area_dup+0x65/0x290 [ 1793.046540][T28382] __should_failslab+0xaf/0xf0 [ 1793.076551][T28382] should_failslab+0x9/0x20 [ 1793.079390][T28403] binder: 28400:28403 ioctl 40086602 20000000 returned -22 [ 1793.080876][T28382] kmem_cache_alloc+0x3b/0x2c0 [ 1793.080911][T28382] vm_area_dup+0x65/0x290 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406310, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1793.088435][T28402] binder: 28401:28402 ioctl 401c5820 20000000 returned -22 [ 1793.092508][T28382] __split_vma+0x1ba/0x880 [ 1793.092541][T28382] do_mas_align_munmap+0x85b/0x1400 [ 1793.112996][T28382] ? kernel_text_address+0xa9/0xe0 [ 1793.115471][T28406] binder: 28405:28406 ioctl 40086602 20000000 returned -22 [ 1793.117938][T28382] ? do_mas_munmap+0x2b0/0x2b0 [ 1793.117974][T28382] ? mas_find+0x4e4/0x520 [ 1793.129524][T28408] binder: 28407:28408 ioctl 401c5820 20000000 returned -22 [ 1793.129568][T28382] do_mas_munmap+0x23e/0x2b0 [ 1793.145195][T28382] mmap_region+0x75c/0x2390 [ 1793.145781][T28410] binder: 28409:28410 ioctl 40086602 20000000 returned -22 [ 1793.149531][T28382] ? file_mmap_ok+0x150/0x150 [ 1793.149561][T28382] ? cap_mmap_addr+0x169/0x2e0 [ 1793.165845][T28382] ? __kasan_check_read+0x11/0x20 [ 1793.170713][T28382] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1793.176613][T28382] ? arch_get_unmapped_area+0x780/0x780 [ 1793.181998][T28382] ? file_mmap_ok+0x104/0x150 [ 1793.186508][T28382] do_mmap+0x853/0xe30 [ 1793.193187][T28382] ? mlock_future_check+0x110/0x110 [ 1793.198223][T28382] vm_mmap_pgoff+0x208/0x430 [ 1793.202648][T28382] ? account_locked_vm+0x250/0x250 [ 1793.207603][T28382] ? __fget_files+0x2cb/0x330 [ 1793.212106][T28382] ksys_mmap_pgoff+0x15d/0x1e0 [ 1793.216705][T28382] __x64_sys_mmap+0x103/0x120 [ 1793.221216][T28382] do_syscall_64+0x3d/0xb0 [ 1793.225469][T28382] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1793.231197][T28382] RIP: 0033:0x7f2a38e7cda9 [ 1793.235454][T28382] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1793.254903][T28382] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1793.263139][T28382] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1793.270956][T28382] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1793.278759][T28382] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 [ 1793.286570][T28382] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2023, 0x0, 0x13, r0, 0x8000000) 10:17:45 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 6) [ 1793.294386][T28382] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1793.302199][T28382] [ 1793.307896][T28412] binder: 28399:28412 ioctl 401c5820 20000000 returned -22 [ 1793.313933][T28414] binder: 28413:28414 ioctl 401c5820 20000000 returned -22 [ 1793.338781][T28418] binder: 28417:28418 ioctl 401c5820 20000000 returned -22 10:17:45 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x1fffff, 0x0, 0x13, r0, 0x8000000) [ 1793.345980][T28420] binder: 28416:28420 ioctl 40086602 20000000 returned -22 [ 1793.361944][T28427] FAULT_INJECTION: forcing a failure. [ 1793.361944][T28427] name failslab, interval 1, probability 0, space 0, times 0 [ 1793.362776][T28422] binder: 28419:28422 ioctl 40086602 20000000 returned -22 [ 1793.376489][T28427] CPU: 0 PID: 28427 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1793.391372][T28427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1793.401263][T28427] Call Trace: [ 1793.404389][T28427] [ 1793.407174][T28427] dump_stack_lvl+0x151/0x1b7 [ 1793.411678][T28427] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1793.416982][T28427] ? __kernel_text_address+0xd/0x40 [ 1793.422005][T28427] dump_stack+0x15/0x1e [ 1793.425997][T28427] should_fail_ex+0x3d0/0x520 [ 1793.430512][T28427] ? mas_alloc_nodes+0x267/0x7d0 [ 1793.435284][T28427] __should_failslab+0xaf/0xf0 [ 1793.439883][T28427] should_failslab+0x9/0x20 [ 1793.444222][T28427] kmem_cache_alloc+0x3b/0x2c0 [ 1793.448826][T28427] mas_alloc_nodes+0x267/0x7d0 [ 1793.453430][T28427] mas_preallocate+0xef2/0x1bd0 [ 1793.458113][T28427] ? mas_destroy+0x3280/0x3280 [ 1793.462883][T28427] ? rwsem_write_trylock+0x15b/0x290 [ 1793.468220][T28427] __vma_adjust+0x6aa/0x1fe0 [ 1793.472693][T28427] ? vm_area_dup+0x65/0x290 [ 1793.477034][T28427] ? vma_start_write+0x160/0x160 [ 1793.482066][T28427] ? rwsem_write_trylock+0x15b/0x290 [ 1793.487187][T28427] __split_vma+0x619/0x880 [ 1793.491442][T28427] do_mas_align_munmap+0x85b/0x1400 [ 1793.496571][T28427] ? kernel_text_address+0xa9/0xe0 [ 1793.501509][T28427] ? do_mas_munmap+0x2b0/0x2b0 [ 1793.506198][T28427] ? mas_find+0x4e4/0x520 [ 1793.510389][T28427] do_mas_munmap+0x23e/0x2b0 [ 1793.515049][T28427] mmap_region+0x75c/0x2390 [ 1793.519656][T28427] ? file_mmap_ok+0x150/0x150 [ 1793.524181][T28427] ? cap_mmap_addr+0x169/0x2e0 [ 1793.528844][T28427] ? __kasan_check_read+0x11/0x20 [ 1793.533718][T28427] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1793.539175][T28427] ? arch_get_unmapped_area+0x780/0x780 [ 1793.544558][T28427] ? file_mmap_ok+0x104/0x150 [ 1793.549070][T28427] do_mmap+0x853/0xe30 [ 1793.552974][T28427] ? mlock_future_check+0x110/0x110 [ 1793.558012][T28427] vm_mmap_pgoff+0x208/0x430 [ 1793.562870][T28427] ? account_locked_vm+0x250/0x250 [ 1793.567901][T28427] ? __fget_files+0x2cb/0x330 [ 1793.572416][T28427] ksys_mmap_pgoff+0x15d/0x1e0 [ 1793.577031][T28427] __x64_sys_mmap+0x103/0x120 [ 1793.581962][T28427] do_syscall_64+0x3d/0xb0 [ 1793.586307][T28427] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1793.592135][T28427] RIP: 0033:0x7f2a38e7cda9 [ 1793.597187][T28427] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1793.617293][T28427] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1793.625544][T28427] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1793.633349][T28427] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1793.641159][T28427] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x7fffdf002000, 0x0, 0x13, r0, 0x8000000) 10:17:45 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.648970][T28427] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1793.656793][T28427] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1793.664597][T28427] [ 1793.687624][T28432] binder: 28431:28432 ioctl 40086602 20000000 returned -22 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406318, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x7ffffffff000, 0x0, 0x13, r0, 0x8000000) 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406325, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xb00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.687936][T28435] binder: 28433:28435 ioctl 401c5820 20000000 returned -22 [ 1793.702534][T28436] binder: 28434:28436 ioctl 401c5820 20000000 returned -22 [ 1793.708561][T28440] binder: 28439:28440 ioctl 40086602 20000000 returned -22 [ 1793.726549][T28442] binder: 28441:28442 ioctl 40086602 20000000 returned -22 [ 1793.740393][T28446] binder: 28444:28446 ioctl 401c5820 20000000 returned -22 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406348, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2, 0x13, r0, 0x8000000) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x13, r0, 0x8000000) 10:17:45 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 7) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.750994][T28448] binder: 28447:28448 ioctl 40086602 20000000 returned -22 [ 1793.761755][T28452] binder: 28451:28452 ioctl 40086602 20000000 returned -22 [ 1793.761836][T28450] binder: 28449:28450 ioctl 401c5820 20000000 returned -22 [ 1793.775715][T28455] binder: 28454:28455 ioctl 401c5820 20000000 returned -22 10:17:45 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 8) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xa, 0x13, r0, 0x8000000) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040634c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x13, r0, 0x8000000) (fail_nth: 9) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xd, 0x13, r0, 0x8000000) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.801340][T28463] binder: 28460:28463 ioctl 40086602 20000000 returned -22 [ 1793.817062][T28465] binder: 28464:28465 ioctl 401c5820 20000000 returned -22 [ 1793.831806][T28471] binder: 28469:28471 ioctl 40086602 20000000 returned -22 [ 1793.834667][T28473] binder: 28472:28473 ioctl 401c5820 20000000 returned -22 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406368, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xd00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.853990][T28475] FAULT_INJECTION: forcing a failure. [ 1793.853990][T28475] name failslab, interval 1, probability 0, space 0, times 0 [ 1793.864868][T28477] binder: 28476:28477 ioctl 40086602 20000000 returned -22 [ 1793.870030][T28480] binder: 28479:28480 ioctl 401c5820 20000000 returned -22 [ 1793.886288][T28475] CPU: 1 PID: 28475 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1793.891335][T28485] binder: 28483:28485 ioctl 40086602 20000000 returned -22 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1793.896262][T28475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1793.896277][T28475] Call Trace: [ 1793.896283][T28475] [ 1793.896291][T28475] dump_stack_lvl+0x151/0x1b7 [ 1793.896322][T28475] ? nf_tcp_handle_invalid+0x3f1/0x3f1 [ 1793.896346][T28475] ? kasan_quarantine_put+0x34/0x1a0 [ 1793.896374][T28475] dump_stack+0x15/0x1e [ 1793.904288][T28484] binder: 28481:28484 ioctl 40086602 20000000 returned -22 [ 1793.913199][T28475] should_fail_ex+0x3d0/0x520 [ 1793.913233][T28475] ? mas_alloc_nodes+0x267/0x7d0 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1793.913257][T28475] __should_failslab+0xaf/0xf0 [ 1793.913283][T28475] should_failslab+0x9/0x20 [ 1793.924098][T28488] binder: 28487:28488 ioctl 401c5820 20000000 returned -22 [ 1793.928896][T28475] kmem_cache_alloc+0x3b/0x2c0 [ 1793.928932][T28475] mas_alloc_nodes+0x267/0x7d0 [ 1793.950675][T28490] binder: 28489:28490 ioctl 40086602 20000000 returned -22 [ 1793.954336][T28475] mas_preallocate+0xef2/0x1bd0 [ 1793.964640][T28492] binder: 28491:28492 ioctl 401c5820 20000000 returned -22 [ 1793.970300][T28475] ? mas_destroy+0x3280/0x3280 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040636c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:45 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xe, 0x13, r0, 0x8000000) [ 1793.970354][T28475] ? mas_prev_slot+0x88c/0x8c0 [ 1793.970375][T28475] vma_expand+0x3c5/0xa20 [ 1793.996213][T28494] binder: 28493:28494 ioctl 40086602 20000000 returned -22 [ 1793.998422][T28475] mmap_region+0xde5/0x2390 [ 1794.005497][T28496] binder: 28495:28496 ioctl 401c5820 20000000 returned -22 [ 1794.007623][T28475] ? file_mmap_ok+0x150/0x150 [ 1794.007653][T28475] ? cap_mmap_addr+0x169/0x2e0 [ 1794.037374][T28501] binder: 28497:28501 ioctl 401c5820 20000000 returned -22 [ 1794.039293][T28475] ? __kasan_check_read+0x11/0x20 10:17:45 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:45 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1794.039327][T28475] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1794.047946][T28502] binder: 28500:28502 ioctl 40086602 20000000 returned -22 [ 1794.051184][T28475] ? arch_get_unmapped_area+0x780/0x780 [ 1794.051220][T28475] ? file_mmap_ok+0x104/0x150 [ 1794.073585][T28475] do_mmap+0x853/0xe30 [ 1794.074611][T28505] binder: 28503:28505 ioctl 401c5820 20000000 returned -22 [ 1794.077490][T28475] ? mlock_future_check+0x110/0x110 [ 1794.077523][T28475] vm_mmap_pgoff+0x208/0x430 [ 1794.077545][T28475] ? account_locked_vm+0x250/0x250 10:17:46 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 10:17:46 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x18000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:46 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0xf, 0x13, r0, 0x8000000) [ 1794.085335][T28506] binder: 28504:28506 ioctl 40086602 20000000 returned -22 [ 1794.089549][T28475] ? __fget_files+0x2cb/0x330 [ 1794.089578][T28475] ksys_mmap_pgoff+0x15d/0x1e0 [ 1794.089602][T28475] __x64_sys_mmap+0x103/0x120 [ 1794.089623][T28475] do_syscall_64+0x3d/0xb0 [ 1794.096018][T28507] binder: 28486:28507 ioctl 401c5820 20000000 returned -22 [ 1794.099010][T28475] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1794.099038][T28475] RIP: 0033:0x7f2a38e7cda9 10:17:46 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x40406374, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:46 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x21, 0x13, r0, 0x8000000) 10:17:46 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:46 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1794.099055][T28475] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1794.099069][T28475] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1794.099087][T28475] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1794.099100][T28475] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1794.099111][T28475] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 [ 1794.099122][T28475] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 10:17:46 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:46 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0xd8, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1794.099134][T28475] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1794.123161][T28509] binder: 28508:28509 ioctl 401c5820 20000000 returned -22 [ 1794.124015][T28475] [ 1794.130728][T28511] binder: 28498:28511 ioctl 40086602 20000000 returned -22 [ 1794.139215][T28514] binder: 28513:28514 ioctl 40086602 20000000 returned -22 [ 1794.147723][T28475] ------------[ cut here ]------------ [ 1794.198406][T28521] binder: 28520:28521 ioctl 40086602 20000000 returned -22 [ 1794.200238][T28475] kernel BUG at mm/mmap.c:2815! [ 1794.219062][T28524] binder: 28523:28524 ioctl 40086602 20000000 returned -22 10:17:46 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f0000000000)={0x110, 0x0, &(0x7f0000000640)=[@transaction={0x4040637a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:46 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x1100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) [ 1794.226736][T28475] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 1794.237798][T28519] binder: 28516:28519 ioctl 40086602 20000000 returned -22 [ 1794.244214][T28475] CPU: 1 PID: 28475 Comm: syz-executor.5 Not tainted 6.1.57-syzkaller-00030-gcfe8cce4e8a1 #0 [ 1794.244240][T28475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 1794.244250][T28475] RIP: 0010:mmap_region+0x225e/0x2390 [ 1794.258122][T28525] binder: 28518:28525 ioctl 401c5820 20000000 returned -22 10:17:46 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0xfff3, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={@fda, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/250}, @fda}, &(0x7f00000000c0)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fd, @fd, @flat=@handle}, &(0x7f00000002c0)}}, @register_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/158}, @ptr={0x70742a85, 0x0, &(0x7f00000003c0)=""/74}}, &(0x7f00000004c0)}}, @decrefs, @clear_death, @dead_binder_done, @clear_death, @dead_binder_done, @dead_binder_done], 0x0, 0x0, 0x0}) 10:17:46 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x8000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x23, 0x13, r0, 0x8000000) [ 1794.261830][T28475] Code: 03 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 1e fc ff ff 48 89 df e8 83 62 09 00 e9 11 fc ff ff e8 79 bf c2 ff 0f 0b e8 72 bf c2 ff <0f> 0b 65 8b 05 79 9b 4f 7e 41 89 c6 4c 89 f0 48 c1 e8 06 48 8d 3c [ 1794.261853][T28475] RSP: 0018:ffffc9000eb5fa40 EFLAGS: 00010246 [ 1794.261871][T28475] RAX: ffffffff81b275de RBX: 0000000020ffefff RCX: 0000000000040000 [ 1794.299052][T28531] binder: 28530:28531 ioctl 401c5820 20000000 returned -22 [ 1794.300973][T28475] RDX: ffffc900013bb000 RSI: 000000000003ffff RDI: 0000000000040000 [ 1794.300993][T28475] RBP: ffffc9000eb5fc50 R08: ffffffff81b26221 R09: ffffffff84ee3d13 [ 1794.301007][T28475] R10: 0000000000000003 R11: ffff88813b591440 R12: ffffc9000eb5fba8 [ 1794.349714][T28536] binder: 28535:28536 ioctl 401c5820 20000000 returned -22 [ 1794.356781][T28475] R13: dffffc0000000000 R14: 0000000020ffd000 R15: 0000000020fff000 [ 1794.356808][T28475] FS: 00007f2a39ca46c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1794.356824][T28475] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1794.356836][T28475] CR2: 00007f36cd3fec98 CR3: 0000000117f79000 CR4: 00000000003506a0 [ 1794.356851][T28475] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1794.356861][T28475] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1794.356873][T28475] Call Trace: [ 1794.356878][T28475] [ 1794.356887][T28475] ? __die_body+0x62/0xb0 [ 1794.428125][T28475] ? die+0x88/0xb0 [ 1794.431680][T28475] ? do_trap+0x103/0x330 [ 1794.435759][T28475] ? mmap_region+0x225e/0x2390 [ 1794.440357][T28475] ? handle_invalid_op+0x95/0xc0 [ 1794.445130][T28475] ? mmap_region+0x225e/0x2390 [ 1794.449731][T28475] ? exc_invalid_op+0x32/0x50 [ 1794.454258][T28475] ? asm_exc_invalid_op+0x1b/0x20 [ 1794.459113][T28475] ? mas_next_slot+0x413/0xb00 [ 1794.463706][T28475] ? mmap_region+0xea1/0x2390 [ 1794.468217][T28475] ? mmap_region+0x225e/0x2390 [ 1794.472832][T28475] ? mmap_region+0x225e/0x2390 [ 1794.477421][T28475] ? file_mmap_ok+0x150/0x150 [ 1794.481936][T28475] ? cap_mmap_addr+0x169/0x2e0 [ 1794.486530][T28475] ? __kasan_check_read+0x11/0x20 [ 1794.491388][T28475] ? shmem_get_unmapped_area+0x2e3/0x710 [ 1794.496858][T28475] ? arch_get_unmapped_area+0x780/0x780 [ 1794.502239][T28475] ? file_mmap_ok+0x104/0x150 [ 1794.506753][T28475] do_mmap+0x853/0xe30 [ 1794.510658][T28475] ? mlock_future_check+0x110/0x110 [ 1794.515690][T28475] vm_mmap_pgoff+0x208/0x430 [ 1794.520119][T28475] ? account_locked_vm+0x250/0x250 [ 1794.525064][T28475] ? __fget_files+0x2cb/0x330 [ 1794.529579][T28475] ksys_mmap_pgoff+0x15d/0x1e0 [ 1794.534189][T28475] __x64_sys_mmap+0x103/0x120 [ 1794.538964][T28475] do_syscall_64+0x3d/0xb0 [ 1794.543207][T28475] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1794.548933][T28475] RIP: 0033:0x7f2a38e7cda9 [ 1794.553186][T28475] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1794.572625][T28475] RSP: 002b:00007f2a39ca40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1794.580869][T28475] RAX: ffffffffffffffda RBX: 00007f2a38fabf80 RCX: 00007f2a38e7cda9 [ 1794.588684][T28475] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffd000 [ 1794.596501][T28475] RBP: 00007f2a39ca4120 R08: 0000000000000003 R09: 0000000008000000 10:17:46 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x401c5820, &(0x7f0000000000)={0x88, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1794.604303][T28475] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 1794.612113][T28475] R13: 000000000000000b R14: 00007f2a38fabf80 R15: 00007fffc8b061b8 [ 1794.619929][T28475] [ 1794.622790][T28475] Modules linked in: [ 1794.627350][T28475] ---[ end trace 0000000000000000 ]--- [ 1794.635096][T28475] RIP: 0010:mmap_region+0x225e/0x2390 [ 1794.640865][T28475] Code: 03 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 1e fc ff ff 48 89 df e8 83 62 09 00 e9 11 fc ff ff e8 79 bf c2 ff 0f 0b e8 72 bf c2 ff <0f> 0b 65 8b 05 79 9b 4f 7e 41 89 c6 4c 89 f0 48 c1 e8 06 48 8d 3c [ 1794.645370][T28540] binder: 28539:28540 ioctl 401c5820 20000000 returned -22 [ 1794.660398][T28475] RSP: 0018:ffffc9000eb5fa40 EFLAGS: 00010246 [ 1794.660426][T28475] RAX: ffffffff81b275de RBX: 0000000020ffefff RCX: 0000000000040000 [ 1794.660440][T28475] RDX: ffffc900013bb000 RSI: 000000000003ffff RDI: 0000000000040000 [ 1794.689457][T28475] RBP: ffffc9000eb5fc50 R08: ffffffff81b26221 R09: ffffffff84ee3d13 [ 1794.697347][T28475] R10: 0000000000000003 R11: ffff88813b591440 R12: ffffc9000eb5fba8 [ 1794.705100][T28475] R13: dffffc0000000000 R14: 0000000020ffd000 R15: 0000000020fff000 [ 1794.713148][T28475] FS: 00007f2a39ca46c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 1794.721985][T28475] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1794.728925][T28475] CR2: 00007efdd21a20b4 CR3: 0000000117f79000 CR4: 00000000003506a0 [ 1794.736744][T28475] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1794.744520][T28475] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1794.752409][T28475] Kernel panic - not syncing: Fatal exception [ 1794.758441][T28475] Kernel Offset: disabled [ 1794.762576][T28475] Rebooting in 86400 seconds..